CVE-2022-35653
published 2022-07-25CVE-2022-35653: A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI…
PriorityP278medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.75%
88.7th percentile
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | — | — |
| moodle | moodle | >= 3.11 < 3.11.8 | 3.11.8 |
| moodle | moodle | >= 3.11.0 < 3.11.8 | 3.11.8 |
| moodle | moodle | >= 3.9 < 3.9.15 | 3.9.15 |
| moodle | moodle | >= 3.9.0 < 3.9.15 | 3.9.15 |
| moodle | moodle | >= 4.0 < 4.0.2 | 4.0.2 |
| redhat | enterprise_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /mod/lti/auth.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
xxx">=1↗
- →Detect exploitation attempts by monitoring POST requests to /mod/lti/auth.php containing a body with a double-quote followed by >= pattern (e.g., xxx">=), which is the XSS injection payload targeting the LTI module. ↗
- →Successful exploitation is confirmed when the HTTP 200 response body contains both the string '' and 'moodle-editor', indicating unsanitized input reflected back in the LTI auth page. ↗
- →Use Shodan queries 'title:"Moodle"', 'cpe:"cpe:2.3:a:moodle:moodle"', or 'http.title:"moodle"' to identify exposed Moodle instances for asset inventory and patch prioritization. ↗
- →This vulnerability only impacts unauthenticated users; session context for authenticated users is not affected. ↗
- ·The Nuclei template targets a single endpoint with max-request: 1, meaning detection coverage is limited to the specific /mod/lti/auth.php POST vector and will not catch variations or other LTI sub-paths. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Moodle LTI module reflected XSS risk
ghsa·2022-07-26
CVE-2022-35653 [MEDIUM] CWE-79 Moodle LTI module reflected XSS risk
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
OSV
Moodle LTI module reflected XSS risk
osv·2022-07-26
CVE-2022-35653 [MEDIUM] Moodle LTI module reflected XSS risk
Moodle LTI module reflected XSS risk
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
OSV
CVE-2022-35653: A reflected XSS issue was identified in the LTI module of Moodle
osv·2022-07-25·CVSS 6.1
CVE-2022-35653 [MEDIUM] CVE-2022-35653: A reflected XSS issue was identified in the LTI module of Moodle
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
VulnCheck
Moodle moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2022·CVSS 6.1
CVE-2022-35653 [MEDIUM] Moodle moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Moodle moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
Affected: Moodle moodle
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable
No detection rules found.
Nuclei
Moodle LTI module Reflected - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2022-35653 [MEDIUM] Moodle LTI module Reflected - Cross-Site Scripting
Moodle LTI module Reflected - Cross-Site Scripting
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks.
Template:
id: CVE-2022-35653
info:
name: Moodle LTI module Reflected - Cross-Site Scripting
author: iamnoooob,pdresearch
severity: medium
description: |
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of u
Greynoiseio
NoiseLetter June 2025
blogs_greynoiseio
NoiseLetter June 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
HackerOne
Reflected XSS via Moodle on ███ [CVE-2022-35653]
hackerone·2024-05-03·CVSS 6.1
CVE-2022-35653 [MEDIUM] Reflected XSS via Moodle on ███ [CVE-2022-35653]
Reflected XSS via Moodle on ███ [CVE-2022-35653]
Hi Security Team
I found an xss vulnerability on your website [CVE-2022-35653]
Refrence : https://vulners.com/nuclei/NUCLEI:CVE-2022-35653
if you wanna test this :
```
id: CVE-2022-35653
info:
name: Moodle LTI module Reflected - Cross-Site Scripting
author: iamnoooob,pdresearch
severity: medium
description: |
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and d
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299https://bugzilla.redhat.com/show_bug.cgi?id=2106277https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/https://moodle.org/mod/forum/discuss.php?d=436460http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72299https://bugzilla.redhat.com/show_bug.cgi?id=2106277https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/https://moodle.org/mod/forum/discuss.php?d=436460
2022-07-25
Published
Exploited in the wild