Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2023-28333

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

VectorNETWORK

PublishedMar 23, 2023, 21:15

Published Bypatrick@puiterwijk.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)4.1.04.1.2N/A

moodle/moodle(Packagist)4.0.04.0.7N/A

moodle/moodle(Packagist)3.11.03.11.13N/A

moodle/moodle(Packagist)03.9.20N/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=2179422
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
https://moodle.org/mod/forum/discuss.php?d=445065

Weakness Type

CWE-94

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK