CVE-2023-28333

Summary

CVE	CVE-2023-28333
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-03-23 21:15:00 UTC
Updated	2023-11-07 04:10:00 UTC
Description	The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

Risk And Classification

Problem Types: CWE-94

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Fedoraproject	Fedora	36	All	All	All
Application	Moodle	Moodle	All	All	All	All
Application	Moodle	Moodle	3.11.0	-	All	All
Application	Moodle	Moodle	3.9.0	-	All	All
Application	Moodle	Moodle	4.0.0	-	All	All
Application	Moodle	Moodle	4.1.0	-	All	All
Application	Moodle	Moodle	4.1.1	All	All	All

References

Reference	Source	Link	Tags
Moodle.org: MSA-23-0008: Pix helper potential Mustache code injection risk	MISC	moodle.org
[SECURITY] Fedora 36 Update: moodle-3.11.13-1.fc36 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 36 Update: moodle-3.11.13-1.fc36 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

283827 Fedora Security Update for moodle (FEDORA-2023-d9c13996b2)