cbcvebase.
CVE-2022-35653
published 2022-07-25

CVE-2022-35653: A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI…

PriorityP278medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.75%
88.7th percentile
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.

Affected

11 ranges
VendorProductVersion rangeFixed in
fedoraprojectfedora
fedoraprojectfedora
moodlemoodle
moodlemoodle
moodlemoodle
moodlemoodle>= 3.11 < 3.11.83.11.8
moodlemoodle>= 3.11.0 < 3.11.83.11.8
moodlemoodle>= 3.9 < 3.9.153.9.15
moodlemoodle>= 3.9.0 < 3.9.153.9.15
moodlemoodle>= 4.0 < 4.0.24.0.2
redhatenterprise_linux

Detection & IOCsextracted from sources · hover to see the quote

url/mod/lti/auth.php
commandPOST /mod/lti/auth.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded xxx">=1
  • Detect exploitation attempts by monitoring POST requests to /mod/lti/auth.php containing a body with a double-quote followed by >= pattern (e.g., xxx">=), which is the XSS injection payload targeting the LTI module.
  • Successful exploitation is confirmed when the HTTP 200 response body contains both the string '' and 'moodle-editor', indicating unsanitized input reflected back in the LTI auth page.
  • Use Shodan queries 'title:"Moodle"', 'cpe:"cpe:2.3:a:moodle:moodle"', or 'http.title:"moodle"' to identify exposed Moodle instances for asset inventory and patch prioritization.
  • This vulnerability only impacts unauthenticated users; session context for authenticated users is not affected.
  • ·The Nuclei template targets a single endpoint with max-request: 1, meaning detection coverage is limited to the specific /mod/lti/auth.php POST vector and will not catch variations or other LTI sub-paths.

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.