CVE-2024-33998
moodle: stored XSS via user's name on participants page when opening some options
Résumé
moodle: stored XSS via user's name on participants page when opening some options
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.10"},{"introduced":"4.2.0"},{"fixed":"4.2.7"},{"introduced":"4.3.0"},{"fixed":"4.3.4"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web moodle.org
- web git.moodle.org