What’s Vulnerable › Vulnerabilities

CVE-2024-38274: moodle: stored XSS via calendar's event title when deleting the event

Description

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Fedoraproject Fedora: 39, 40
Moodle: from 4.1.0 before 4.1.11; from 4.2.0 before 4.2.8; from 4.3.0 before 4.3.5; 4.4.0 — fixed in 4.1.11, 4.2.8, 4.3.5

Upgrade to a fixed version: Moodle 4.1.11, 4.2.8, 4.3.5. Check the vendor advisory for mitigations.