PT-2022-5145 · Moodle+2 · Moodle+2

Adam Roberts · Published 2020-11-08 · Updated 2025-05-20 · CVE-2022-40313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue is related to the recursive rendering of Mustache template helpers containing user input, which could result in a Cross-site Scripting risk or a page failing to load. This is due to insufficient cleaning of user data in the Mustache template helpers. An attacker could exploit this issue by creating a malicious link that, when clicked, would execute arbitrary HTML and script code in the user's browser within the context of the vulnerable website.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2023-2012

ALT-PU-2023-2057

ALT-PU-2023-5127

BDU:2022-06402

BIT-MOODLE-2022-40313

CVE-2022-40313

GHSA-JQGR-GH62-JF53

Affected Products

Alt Linux

Moodle

Red Os

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2022-40313 · Security Note
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40313 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40313 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06402 · Security Note
• https://osv.dev/vulnerability/BIT-moodle-2022-40313 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-40313 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=438392 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-40313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqgr-gh62-jf53 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2128146 · Note
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-68066 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-cve-2022-40316-cve-2022-40315-cve-2022-40314-cve-2022-40313-cve-20 · Note
• https://t.me/cibsecurity/50781 · Telegram Post