PT-2023-32168 · Moodle+8 · Moodle+6

Paul Holden · CVE-2023-5546 · Published 2023-11-09 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Software (affected versions not specified)

Description The issue concerns a stored XSS risk in the quiz grading report, where ID numbers were not properly sanitized. This could potentially allow for malicious script execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MOODLE-2023-5546

CVE-2023-5546

GHSA-9724-H8P7-R3JV

Affected Products

Moodle

Ckeditor4

Enterprise Linux

Fedora

Moodle/Moodle

Upx

Wireshark

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5546.json · Exploit
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78971 · Patch
• https://osv.dev/vulnerability/GHSA-9724-h8p7-r3jv · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2023-5546 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-5546 · Security Note
• https://ubuntu.com/security/CVE-2023-5546 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5546 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=451587 · Patch
• https://osv.dev/vulnerability/CVE-2023-5546 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/aa8ab48521fe4a57c3ec923e6e82a5ac1202e9de · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2243445 · Note
• https://twitter.com/CVEnew/status/1722703741323792493 · Twitter Post
• https://git.moodle.org · Note