CVE-2023-28332: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

March 23, 2023 (updated November 9, 2023)

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

References

git.moodle.org/gw?p=moodle.git;a=commitdiff;h=9f178c1f816e78ec024ab16a10192c81305b2624
github.com/advisories/GHSA-9f45-9qrw-pp4v
github.com/moodle/moodle/commit/9f178c1f816e78ec024ab16a10192c81305b2624
moodle.org/mod/forum/discuss.php?d=445064
nvd.nist.gov/vuln/detail/CVE-2023-28332

Detect and mitigate CVE-2023-28332 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →