Mustache Injection Vulnerability in Moodle LMS by Moodle
CVE-2023-28333

9.8CRITICAL

Key Information:

Vendor

Moodle
Status
moodle
Vendor
CVE Published:
23 March 2023

What is CVE-2023-28333?

The Mustache pix helper in Moodle LMS presents a potential Mustache injection risk when combined with user input. While this vulnerability does not appear to be actively exploitable within the core Moodle implementation, it highlights the importance of validating user input effectively to mitigate such risks. Organizations using Moodle should remain vigilant and ensure that any extensions or custom implementations that utilize the Mustache templating engine are properly secured against injection attacks.

Affected Version(s)

moodle 4.1 to 4.1.1, 4.0 to 4.0.6, 3.11 to 3.11.12, 3.9 to 3.9.19 and earlier unsupported versions

References

https://moodle.org/mod/forum/discuss.php?d=445065
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.