CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says "If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text." This page also says "Chat is due to be removed from standard Moodle."

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.moodle.org/403/en/Using_Chat	Product
https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt	Third Party Advisory
https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe	Not Applicable
https://docs.moodle.org/403/en/Using_Chat	Product
https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt	Third Party Advisory
https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:moodle:moodle:4.3.3:*:*:*:*:*:*:*

History

01 May 2025, 15:05

Type	Values Removed	Values Added
References	~~() https://docs.moodle.org/403/en/Using_Chat -~~	() https://docs.moodle.org/403/en/Using_Chat - Product
References	~~() https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt -~~	() https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt - Third Party Advisory
References	~~() https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe -~~	() https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe - Not Applicable
CPE		cpe:2.3:a:moodle:moodle:4.3.3:::::::*
First Time		Moodle Moodle moodle

21 Nov 2024, 09:06

Type	Values Removed	Values Added
References	~~() https://docs.moodle.org/403/en/Using_Chat -~~	() https://docs.moodle.org/403/en/Using_Chat -
References	~~() https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt -~~	() https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt -
References	~~() https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe -~~	() https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe -

05 Nov 2024, 15:35

Type	Values Removed	Values Added
CWE		CWE-94
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4

11 Apr 2024, 01:25

Type	Values Removed	Values Added
Summary		(es) La actividad Chat en Moodle 4.3.3 permite a los estudiantes insertar un elemento HTML A o un elemento IMG potencialmente no deseado, o contenido HTML que conduce a una degradación del rendimiento. NOTA: la página Usando_Chat del proveedor dice "Si conoce algún código HTML, puede usarlo en su texto para hacer cosas como insertar imágenes, reproducir sonidos o crear texto de diferentes colores y tamaños". Esta página también dice "El chat debe eliminarse de Moodle estándar".

22 Mar 2024, 15:34

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-22 15:15

Updated : 2025-05-01 15:05

NVD link : CVE-2024-28593

Mitre link : CVE-2024-28593

CVE.ORG link : CVE-2024-28593

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-28593", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2024-03-22T15:15:15.453", "references": [{"url": "https://docs.moodle.org/403/en/Using_Chat", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://docs.moodle.org/403/en/Using_Chat", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gist.githubusercontent.com/minendie/4f23174687bc4d8eb7f727d9959b5399/raw/9ce573cebcce5521d9d6f826ab68f3780036b874/CVE-2024-28593.txt", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://medium.com/%40lamscun/how-do-i-change-htmli-from-low-to-critical-your-email-box-is-safe-e7171efd88fe", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's Using_Chat page says \"If you know some HTML code, you can use it in your text to do things like insert images, play sounds or create different coloured and sized text.\" This page also says \"Chat is due to be removed from standard Moodle.\""}, {"lang": "es", "value": "La actividad Chat en Moodle 4.3.3 permite a los estudiantes insertar un elemento HTML A o un elemento IMG potencialmente no deseado, o contenido HTML que conduce a una degradaci\u00f3n del rendimiento. NOTA: la p\u00e1gina Usando_Chat del proveedor dice \"Si conoce alg\u00fan c\u00f3digo HTML, puede usarlo en su texto para hacer cosas como insertar im\u00e1genes, reproducir sonidos o crear texto de diferentes colores y tama\u00f1os\". Esta p\u00e1gina tambi\u00e9n dice \"El chat debe eliminarse de Moodle est\u00e1ndar\"."}], "lastModified": "2025-05-01T15:05:31.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:4.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D1B03C6-3C1B-4A47-85BC-67E2C4D43707"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.4 /10