MEDIUM6.1
GHSA-28gc-4qq5-8q26
Moodle Cross-site Scripting vulnerability
Quick fix
GHSA-28gc-4qq5-8q26 — moodle/moodle: upgrade to the fixed version with the command below.
composer require moodle/moodle:^4.3.0-rc2Details
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/moodle/moodle
Introduced in:
0Fixed in: 4.3.0-rc2Fix
composer require moodle/moodle:^4.3.0-rc2References
- https://nvd.nist.gov/vuln/detail/CVE-2023-5541[ADVISORY]
- https://github.com/moodle/moodle/commit/f5f6ce375e37da902afb043c6b506129fc433233[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2243437[WEB]
- https://github.com/moodle/moodle[PACKAGE]
- https://moodle.org/mod/forum/discuss.php?d=451582[WEB]
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79426[WEB]