CVE-2022-50943
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Moodle LMS 4.0 has a cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to inject malicious scripts via the search parameter in course/search.php. Attackers can execute arbitrary JavaScript in users' browsers and steal session cookies.
Risk Assessment
An attacker can hijack user sessions, gain access to accounts and data, and spread malicious content within the LMS system.
Recommendation
Upgrade Moodle LMS to version 4.0.1 or later, which includes input filtering for the search parameter.
Original NVD description (English source)
Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users' browsers and steal session cookies.