Vulnerability Description
A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | >= 3.9.0, < 3.9.15 |
| Redhat | Enterprise Linux | 8.0 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71921PatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2106275Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://moodle.org/mod/forum/discuss.php?d=436458Vendor Advisory
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71921PatchVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2106275Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://moodle.org/mod/forum/discuss.php?d=436458Vendor Advisory
FAQ
What is CVE-2022-35651?
CVE-2022-35651 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remote attacker can trick the victim to follo...
How severe is CVE-2022-35651?
CVE-2022-35651 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-35651?
Check the references section above for vendor advisories and patch information. Affected products include: Moodle Moodle, Redhat Enterprise Linux, Fedoraproject Fedora.