GHSA-q6vw-27c6-jv9c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q6vw-27c6-jv9c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q6vw-27c6-jv9c/GHSA-q6vw-27c6-jv9c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q6vw-27c6-jv9c
- Aliases
- Published
- 2022-05-24T22:28:53Z
- Modified
- 2024-04-24T00:11:49.129294Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Moodle Persistent Cross-site Scripting (XSS)
- Details
-
Persistent XSS in
/course/modedit.phpof Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug." - Database specific
{ "nvd_published_at": "2020-02-11T14:15:00Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-04-23T23:39:18Z" }- References
Affected packages
Packagist / moodle/moodle
Package
- Name
- moodle/moodle
- Purl
- pkg:composer/moodle/moodle