Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. moodle/moodle
  4. ›
  5. CVE-2024-28593

CVE-2024-28593: Cross-site Scripting in Moodle Chat

March 22, 2024 (updated November 5, 2024)

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor’s Using_Chat page says “If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text.” This page also says “Chat is due to be removed from standard Moodle.”

References

  • docs.moodle.org/403/en/Using_Chat
  • gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt
  • github.com/advisories/GHSA-f6mh-79vh-2hv7
  • github.com/moodle/moodle
  • medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe
  • nvd.nist.gov/vuln/detail/CVE-2024-28593

Code Behaviors & Features

Detect and mitigate CVE-2024-28593 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 4.3.3

Solution

Unfortunately, there is no solution available yet.

Impact 5.4 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Learn more about CVSS

Weakness

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Source file

packagist/moodle/moodle/CVE-2024-28593.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:02 +0000.