The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NMoodle
APPMoodle< 4.1.104.2.0 – 4.2.7 (excl.)4.3.0 – 4.3.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2024-33999CRITICAL9.8PL ✓same product
Moodle MFA — niewystarczająca sanityzacja URL referrer
CVE-2023-28333CRITICAL9.8PL ✓same product
Moodle: potencjalny Mustache injection w pomocniku Mustache pix
CVE-2021-36392CRITICAL9.8PL ✓same product
SQL Injection w Moodle — biblioteka pobierania kursów użytkownika
CVE-2021-36393CRITICAL9.8PL ✓same product
SQL injection w bibliotece pobierania ostatnich kursów użytkownika w Moodle
CVE-2021-36394CRITICAL9.8PL ✓same product
RCE w pluginie uwierzytelniania Shibboleth w Moodle