CVE-2023-5541

LOW

Moodle 3.9.0-3.9.23 and <4.3.0-rc2 - Stored Cross-Site Scripting via CSV Grade Import

Title source: llm
STIX 2.1

Description

The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.

References (3)

Core 3

Scores

CVSS v3 3.3
EPSS 0.0014
EPSS Percentile 33.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
moodle/moodle 0 - 4.3.0-rc2Packagist
moodle/moodle 3.9.0 - 3.9.24
Published Nov 09, 2023
Tracked Since Feb 18, 2026