Reflected XSS Vulnerability in Moodle by Moodle

CVE-2023-46858

Summary

Moodle version 4.3 introduces a vulnerability that allows reflected cross-site scripting (XSS) through the /grade/report/grader/index.php endpoint when users are logged in as teachers. This vulnerability arises when teachers utilize forms of rich content to enhance their courses, potentially leading to exploitation if malicious content is submitted. Importantly, while admin and teacher accounts can be compromised, student accounts are safeguarded from posting such content. Addressing this vulnerability is crucial to maintaining the integrity and security of Moodle's educational platforms.

References