CVE-2022-50943

MEDIUM severity · CVSS 6.1 · Cross-site scripting (XSS)

6.1CVSS MEDIUM

Summary

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users' browsers and steal session cookies.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

Moodle

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://git.in.moodle.com/moodle
https://moodle.org/
https://www.vulncheck.com/advisories/moodle-lms-cross-site-scripting-via-course-search-phpAdvisory
https://www.exploit-db.com/exploits/51115Exploit