CVE-2023-23921

UNKNOWN 0.0

Moodle: reflected xss risk in some returnurl parameters

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.

CWE	CWE-79
Published	Feb 17, 2023
Last Updated	Aug 2, 2024

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new unknown vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

References

NVD ↗ CVE.org ↗ EPSS Data ↗

git.moodle.org: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-76810 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2162526 moodle.org: https://moodle.org/mod/forum/discuss.php?d=443272#p1782021

Credits

Upstream acknowledges DegrangeM as the original reporter.