CVE-2022-40313
published 2022-09-30CVE-2022-40313: Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
PriorityP426high7.1CVSS 3.1
AVNACLPRNUIRSCCLILAL
EPSS
0.54%
41.8th percentile
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| moodle | moodle | — | — |
| moodle | moodle | >= 3.11 < 3.11.10 | 3.11.10 |
| moodle | moodle | >= 3.11.0 < 3.11.10 | 3.11.10 |
| moodle | moodle | >= 3.9 < 3.9.17 | 3.9.17 |
| moodle | moodle | >= 3.9.0 < 3.9.17 | 3.9.17 |
| moodle | moodle | >= 4.0 < 4.0.4 | 4.0.4 |
| moodle | moodle | >= 4.0.0 < 4.0.4 | 4.0.4 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
osv7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenNMS vulnerable to remote code execution
ghsa·2023-08-17
CVE-2023-40313 [HIGH] CWE-94 OpenNMS vulnerable to remote code execution
OpenNMS vulnerable to remote code execution
A BeanShell interpreter in remote server mode runs in OpenNMS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OSV
Moodle Stored Cross-site Scripting and page denial of service
osv·2022-10-01
CVE-2022-40313 [HIGH] Moodle Stored Cross-site Scripting and page denial of service
Moodle Stored Cross-site Scripting and page denial of service
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an Cross-site Scripting risk or a page failing to load.
GHSA
Moodle Stored Cross-site Scripting and page denial of service
ghsa·2022-10-01
CVE-2022-40313 [HIGH] CWE-79 Moodle Stored Cross-site Scripting and page denial of service
Moodle Stored Cross-site Scripting and page denial of service
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an Cross-site Scripting risk or a page failing to load.
OSV
CVE-2022-40313: Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load
osv·2022-09-30·CVSS 7.1
CVE-2022-40313 [HIGH] CVE-2022-40313: Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load
Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-30
Published