Vulnerability Details : CVE-2023-35131
Content on the groups page required additional sanitizing to prevent an XSS risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8 and 3.11 to 3.11.14.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2023-35131
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:4.2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-35131
0.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-35131
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
Fedora Project | 2024-04-19 |
CWE ids for CVE-2023-35131
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by:
- nvd@nist.gov (Primary)
- patrick@puiterwijk.org (Secondary)
References for CVE-2023-35131
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
[SECURITY] Fedora 38 Update: moodle-4.1.4-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://bugzilla.redhat.com/show_bug.cgi?id=2214369
2214369 – (CVE-2023-35131, MSA-23-0016) CVE-2023-35131 moodle: XSS risk on groups page
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
[SECURITY] Fedora 37 Update: moodle-4.1.4-1.fc37 - package-announce - Fedora Mailing-Lists
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
[SECURITY] Fedora 38 Update: moodle-4.1.4-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://moodle.org/mod/forum/discuss.php?d=447829
Moodle challengePatch;Vendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
[SECURITY] Fedora 37 Update: moodle-4.1.4-1.fc37 - package-announce - Fedora Mailing-Lists
Jump to