Vulnerability vector:
- Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Severity (CVSSv3.1): 8.4 (high)
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
- Severity (CVSSv4.0): 8.3 (high)
Description:
The vulnerability was identified in Moodle versions 4.5; 4.4 - 4.4.4; 4.3 - 4.3.8.
The discovered vulnerability, which exists due to a lack of filtering during course editing, can be exploited by an attacker to embed an arbitrary JavaScript code into the body of a page.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 09.12.2024
Recommendations:
- Update to versions 4.3.9, 4.4.5, 4.5.1 or higher
Additional information:
Researcher: Andrey Alekseev (Positive Technologies)