PT-2022-4072 · Moodle+2 · Moodle+2

Rekter0 · Published 2020-11-08 · Updated 2024-03-06 · CVE-2022-35651

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A stored XSS and blind SSRF issue exists due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in the user's browser in the context of the vulnerable website to steal potentially sensitive information, change the appearance of the web page, perform phishing, and drive-by-download attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2022-2502

ALT-PU-2022-2553

BDU:2022-04906

BIT-MOODLE-2022-35651

CVE-2022-35651

GHSA-WWV7-H477-WRV7

Affected Products

Alt Linux

Moodle

Red Os

References · 24

• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://osv.dev/vulnerability/GHSA-wwv7-h477-wrv7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35651 · Security Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71921 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=436458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35651 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04906 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35651 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35651 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-35651 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35651 · Security Note