Описание
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the event.
Ссылки
- Product
- ExploitThird Party AdvisoryVDB Entry
- Third Party Advisory
Уязвимые конфигурации
EPSS
7.2 High
CVSS3
6.1 Medium
CVSS3
Дефекты
Связанные уязвимости
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability ...
Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts. Attackers can craft a calendar event with malicious JavaScript in the subtitle track label to execute arbitrary code when users view the event.
Уязвимость поля субтитров событий календаря виртуальной обучающей среды Moodle, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)
ALT-PU-2021-1777: package `moodle` update to version 3.10.4-alt1
EPSS
7.2 High
CVSS3
6.1 Medium
CVSS3