CVE-2024-38274

moodle: stored XSS via calendar's event title when deleting the event

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami moodle

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.11"},{"introduced":"4.2.0"},{"fixed":"4.2.8"},{"introduced":"4.3.0"},{"fixed":"4.3.5"},{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}]

Références

advisory moodle.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web nvd.nist.gov