PT-2023-32168 · Moodle+8 · Moodle+6

Paul Holden · Published 2023-11-09 · Updated 2024-03-06 · CVE-2023-5546

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue concerns a stored XSS risk in the quiz grading report, where ID numbers were not properly sanitized. This could potentially allow for malicious script execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MOODLE-2023-5546

CVE-2023-5546

GHSA-9724-H8P7-R3JV

Affected Products

Moodle

Ckeditor4

Enterprise Linux

Fedora

Moodle/Moodle

Upx

Wireshark

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-5546 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=451587 · Patch
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78971 · Patch
• https://osv.dev/vulnerability/GHSA-9724-h8p7-r3jv · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5546 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-5546 · Security Note
• https://ubuntu.com/security/CVE-2023-5546 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2023-5546 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5546 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/aa8ab48521fe4a57c3ec923e6e82a5ac1202e9de · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2243445 · Note
• https://twitter.com/CVEnew/status/1722703741323792493 · Twitter Post