Cross-Site Request Forgery Risk in Moodle Database Templates
CVE-2023-28335

8.8HIGH

Key Information:

Vendor

Moodle
Status
moodle
Vendor
CVE Published:
23 March 2023

What is CVE-2023-28335?

A vulnerability has been identified in the Moodle platform, where the link to reset all templates of a database activity fails to include the required CSRF token. This oversight creates a risk of unauthorized actions being performed on behalf of logged-in users, potentially leading to data manipulation or disclosure. It is crucial for users to apply the latest updates to mitigate this security threat.

Affected Version(s)

moodle 4.1 to 4.1.1

References

https://moodle.org/mod/forum/discuss.php?d=445067

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.