Moodle XSS Vulnerability
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jan 26, 2024
Package
Affected versions
>= 3.6.0, < 3.6.3
>= 3.5.0, < 3.5.5
>= 3.2.0, < 3.4.8
< 3.1.17
Patched versions
3.6.3
3.5.5
3.4.8
3.1.17
Description
Published by the National Vulnerability Database
Mar 27, 2019
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 18, 2023
Last updated
Jan 26, 2024
Credits
-
MarkLee131 Analyst
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
References