TI-2022-16119 Aliases CVE-2022-35653 GHSA-62wh-m4jr-233r

Cross-site scripting in Moodle

LOW 35CWE-79Published 2022-07-25 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Why it matters now

EPSS 0.04842 92nd percentileScored 2026-11-07

Fix Fixed moodle/moodle (Packagist): 4.0.2, 3.11.8, 3.9.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Moodle	Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15	—	No fix listed	CNA
—	moodle/moodle (Packagist)	4.0 to before 4.0.2	4.0.2	Patch available	GHSA-62wh-m4jr-233r
—	moodle/moodle (Packagist)	3.11 to before 3.11.8	3.11.8	Patch available	GHSA-62wh-m4jr-233r
—	moodle/moodle (Packagist)	3.9 to before 3.9.15	3.9.15	Patch available	GHSA-62wh-m4jr-233r

Moodle Vendor— Affected Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15 Fixed in — No fix listed CNA
moodle/moodle (Packagist) Vendor— Affected 4.0 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-62wh-m4jr-233r
moodle/moodle (Packagist) Vendor— Affected 3.11 to before 3.11.8 Fixed in 3.11.8 Patch available GHSA-62wh-m4jr-233r
moodle/moodle (Packagist) Vendor— Affected 3.9 to before 3.9.15 Fixed in 3.9.15 Patch available GHSA-62wh-m4jr-233r

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:moodle:moodle::::::::	3.9.0 to before 3.9.15; 3.11.0 to before 3.11.8	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:-::::::	4.0.0	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:beta::::::	4.0.0 beta	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc1::::::	4.0.0 rc1	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc2::::::	4.0.0 rc2	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc3::::::	4.0.0 rc3	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc4::::::	4.0.0 rc4	Vulnerable	Moodle
cpe:2.3:a:moodle:moodle:4.0.1:::::::*	4.0.1	Vulnerable	Moodle
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:::::::*	36	Vulnerable	Fedoraproject

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* Versions 3.9.0 to before 3.9.15; 3.11.0 to before 3.11.8 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:beta:*:*:*:*:*:* Versions 4.0.0 beta Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc1:*:*:*:*:*:* Versions 4.0.0 rc1 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc2:*:*:*:*:*:* Versions 4.0.0 rc2 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc3:*:*:*:*:*:* Versions 4.0.0 rc3 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.0:rc4:*:*:*:*:*:* Versions 4.0.0 rc4 Vulnerable ·Moodle
cpe:2.3:a:moodle:moodle:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Moodle
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	8.0	Vulnerable	Red Hat

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat

Remediation

Fix · GHSA-62wh-m4jr-233r moodle/moodle (Packagist) Fixed in 4.0.2 Advisory →
Fix · GHSA-62wh-m4jr-233r moodle/moodle (Packagist) Fixed in 3.11.8 Advisory →
Fix · GHSA-62wh-m4jr-233r moodle/moodle (Packagist) Fixed in 3.9.15 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-07-25
Moodle — FEDORA-2022-81ce74b2dd
5 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-16116 Path traversal in MoodlePriority HIGH 65
- TI-2022-16115 Code injection in MoodlePriority MEDIUM 53
- TI-2022-16118 Open redirect in MoodlePriority LOW 29
Show all 5 records → Advisory →
Advisory · 2022-07-25
Moodle — FEDORA-2022-7e7ce7df2e
5 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2022-16116 Path traversal in MoodlePriority HIGH 65
- TI-2022-16115 Code injection in MoodlePriority MEDIUM 53
- TI-2022-16118 Open redirect in MoodlePriority LOW 29
Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2022-35653
2026-10-03 Alias added: GHSA-62wh-m4jr-233r

References

Patch 2

Advisory 4

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences