PT-2023-3323 · Moodle+1 · Moodle+1
Zack Miele
·
Publicado
2023-02-17
·
Atualizado
2024-03-06
·
CVE-2023-23922
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Moodle (affected versions not specified)
Description
The issue exists due to insufficient sanitization of user-supplied data in the blog search function. A remote attacker can trick the victim into following a specially crafted link, allowing the execution of arbitrary HTML and script code in the user's browser within the context of the vulnerable website. This flaw enables a remote attacker to perform cross-site scripting (XSS) attacks, potentially leading to the theft of confidential information, modification of the webpage's appearance, and execution of phishing attacks or drive-by downloads.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moodle
Red Os