Medium severity · published Jul 25, 2022
CVE-2022-35653
A reflected XSS issue was identified in the LTI module of Moodle
6.1
CVSS
4.8%
EPSS
No
On KEV
Description
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Moodle ·
Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 · source: vendor, NVD
EL
Enterprise Linux · Redhat
8.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-35653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-35653
Patch
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2106277
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/
Patch
https://moodle.org/mod/forum/discuss.php?d=436460
More from Moodle
9.8
CVE-2021-36394
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin
9.8
CVE-2021-36392
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses
9.8
CVE-2021-36393
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses
9.8
CVE-2022-40315
A limited SQL injection risk was identified in the "browse list of users" site administration page
9.8
CVE-2022-40314
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified