Cross-Site Scripting Vulnerability in Moodle H5P

CVE-2024-43439

Summary

A vulnerability has been identified in Moodle's H5P component, where error messages are not properly sanitized. This oversight can lead to reflected cross-site scripting (XSS), potentially allowing attackers to execute malicious scripts in the context of users' sessions. If exploited, this vulnerability could compromise user data and lead to unauthorized actions on the part of an attacker. Proper sanitization of inputs and error messages is essential to mitigate such risks and ensure the security of the Moodle environment.

References