Vulnerability Description
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Moodle | Moodle | < 4.1.22 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2025-67850Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2423838Issue TrackingThird Party Advisory
FAQ
What is CVE-2025-67850?
CVE-2025-67850 is a vulnerability with a CVSS score of 7.3 (HIGH). A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A rem...
How severe is CVE-2025-67850?
CVE-2025-67850 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-67850?
Check the references section above for vendor advisories and patch information. Affected products include: Moodle Moodle.