CVE-2025-67850

HIGH7.3EPSS 0.01%

Moodle vulnerable to Cross-site Scripting

發布日:2026/2/3修改日:2026/2/12

也稱為:GHSA-6mmv-f6c6-v6q8BIT-moodle-2025-67850

描述

A flaw was found in Moodle. This vulnerability, known as Cross-site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expression fields. A remote attacker could inject malicious code into these fields. When other users view these expressions, the malicious code would execute in their web browsers, potentially compromising their data or leading to unauthorized actions.

受影響套件(2)

Bitnami/moodlefrom 0, < 4.1.22, >= 4.4.0, < 4.4.11, >= 4.5.0, < 4.5.8, >= 5.0.0, < 5.0.4, >= 5.1.0, < 5.1.1
Packagist/moodle/moodlefrom 0, < 4.1.22

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-67850
PATCHhttps://github.com/moodle/moodle
WEBhttps://access.redhat.com/security/cve/CVE-2025-67850
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2423838
WEBhttps://github.com/moodle/moodle/commit/c85f153068a717a3b28bc122e75154bac99e67e1
WEBhttps://moodle.org/mod/forum/discuss.php?d=471300