PT-2023-3324 · Moodle+2 · Moodle+2

Degrange

·

Publicado

2020-11-08

·

Atualizado

2024-03-06

·

CVE-2023-23921

CVSS v2.0

6.4

Média

VetorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)
Description The issue exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in the user's browser in the context of the vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks, potentially stealing confidential information, modifying the appearance of web pages, and conducting phishing attacks or drive-by downloads.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2020-3235
ALT-PU-2023-2012
ALT-PU-2023-2057
ALT-PU-2023-5127
BDU:2023-03478
BIT-MOODLE-2023-23921
CVE-2023-23921
GHSA-97QF-PQ7X-964M

Produtos afetados

Alt Linux
Moodle
Red Os