description: A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
problem types: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
vendor: n/a
product: Moodle
versions:
version: Fixed in moodle 4.0.5, moodle 3.11.11, moodle 3.9.18, status: affected
}