CVE-2022-35653

MEDIUMNuclei

Moodle LTI module reflected XSS risk

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2022-35653 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Feb 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

3
ProductSourceVersion range

moodle

Browse Moodle / moodle
VulnCheckVersion data not supplied

Moodle

CVE ListFixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15affected

moodle/moodle

Browse Packagist / moodle/moodle
GitHub Advisory4.0 to < 4.0.2 · Fixed in 4.0.2affected
3.11 to < 3.11.8 · Fixed in 3.11.8affected
3.9 to < 3.9.15 · Fixed in 3.9.15affected

Nuclei templates

1
ProjectDiscoveryMEDIUMMoodle LTI module Reflected - Cross-Site ScriptingCVSS 6.1

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.

Impact

Attackers can inject malicious JavaScript through the LTI module that executes in educators' or students' browsers, potentially stealing Moodle session credentials and accessing sensitive course information.

Remediation

Update Moodle to a patched version that properly sanitizes user input in the LTI module and prevents execution of injected scripts.

WeaknessesCWE-79
Authorsiamnoooob, pdresearch
Template tagscvecve2022moodlexssvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Shodan: title:"Moodle"
Shodan: cpe:"cpe:2.3:a:moodle:moodle"
Shodan: http.title:"moodle"
FOFA: title="moodle"
Google: intitle:"moodle"
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299 https://nvd.nist.gov/vuln/detail/CVE-2022-35653 https://bugzilla.redhat.com/show_bug.cgi?id=2106277 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/

Source: ProjectDiscovery

References

9