PT-2022-4074 · Moodle+2 · Moodle+2

Luuk Verhoeven · Published 2020-11-08 · Updated 2024-05-04 · CVE-2022-35653

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A reflected XSS issue was identified in the LTI module of Moodle due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in the user's browser in the context of the vulnerable website to steal potentially sensitive information, change the appearance of the web page, perform phishing, and drive-by-download attacks. This issue does not impact authenticated users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2022-2502

ALT-PU-2022-2553

BDU:2022-04908

BIT-MOODLE-2022-35653

CVE-2022-35653

GHSA-62WH-M4JR-233R

Affected Products

Alt Linux

Moodle

Red Os

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2022-35653 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35653 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=436460 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3 · Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35653 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://bdu.fstec.ru/vul/2022-04908 · Security Note
• https://osv.dev/vulnerability/GHSA-62wh-m4jr-233r · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-35653 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35653 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35653 · Security Note