CVE-2024-33998
moodle: stored XSS via user's name on participants page when opening some options
Summary
moodle: stored XSS via user's name on participants page when opening some options
Original description
The description as published by the source.
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.10"},{"introduced":"4.2.0"},{"fixed":"4.2.7"},{"introduced":"4.3.0"},{"fixed":"4.3.4"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web moodle.org
- web git.moodle.org