CVE-2023-40320 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2023-40320

CVE-2023-40320

Published:May 15, 2026

Updated:May 15, 2026

moodle: Stored self-XSS escalated to stored XSS via OAuth 2 login

Affected Packages

moodle/moodle (PHP):

Affected version(s) >=v3.6.6 <v3.7.0-rc2

Fix Suggestion:

Update to version v3.7.0-rc2

moodle/moodle (PHP):

Affected version(s) =v4.0.0-beta <v4.0.0-rc1

Fix Suggestion:

Update to version v4.0.0-rc1

moodle/moodle (PHP):

Affected version(s) >=v3.10.10 <v3.11.2

Fix Suggestion:

Update to version v3.11.2

moodle/moodle (PHP):

Affected version(s) >=v3.11.6 <v3.11.16

Fix Suggestion:

Update to version v3.11.16

moodle/moodle (PHP):

Affected version(s) >=v3.4.0-beta <v3.4.5

Fix Suggestion:

Update to version v3.4.5

moodle/moodle (PHP):

Affected version(s) =v3.7.0 <v3.7.1

Fix Suggestion:

Update to version v3.7.1

moodle/moodle (PHP):

Affected version(s) >=v4.2.0-beta <v4.2.2

Fix Suggestion:

Update to version v4.2.2

moodle/moodle (PHP):

Affected version(s) >=v4.1.0-beta <v4.1.5

Fix Suggestion:

Update to version v4.1.5

moodle/moodle (PHP):

Affected version(s) >=v3.9.16 <v3.9.23

Fix Suggestion:

Update to version v3.9.23

moodle/moodle (PHP):

Affected version(s) >=v3.9.13 <v3.9.15

Fix Suggestion:

Update to version v3.9.15

agattitech/moodle_boilerplate (PHP):

Affected version(s) >=dev-master <=3.9.20

Fix Suggestion:

Update to version no_fix

moodle/moodle (PHP):

Affected version(s) >=v3.10.0-beta <v3.10.6

Fix Suggestion:

Update to version v3.10.6

moodle/moodle (PHP):

Affected version(s) >=v3.4.9 <v3.5.2

Fix Suggestion:

Update to version v3.5.2

drakeba/moodle-core (PHP):

Affected version(s) >=dev-bamaster <=4.1.1

Fix Suggestion:

Update to version no_fix

moodle/moodle (PHP):

Affected version(s) >=v4.0.0-rc2 <v4.0.10

Fix Suggestion:

Update to version v4.0.10

moodle/moodle (PHP):

Affected version(s) >=v3.7.9 <v3.8.1

Fix Suggestion:

Update to version v3.8.1

moodle/moodle (PHP):

Affected version(s) >=v3.8.2 <v3.8.5

Fix Suggestion:

Update to version v3.8.5

moodle/moodle (PHP):

Affected version(s) =v3.5.6 <v3.5.7

Fix Suggestion:

Update to version v3.5.7

moodle/moodle (PHP):

Affected version(s) >=v3.8.6 <v3.9.9

Fix Suggestion:

Update to version v3.9.9

moodle/moodle (PHP):

Affected version(s) =dev-MOODLE_310_STABLE <dev-MOODLE_311_STABLE

Fix Suggestion:

Update to version dev-MOODLE_311_STABLE

moodle/moodle (PHP):

Affected version(s) >=dev-MOODLE_33_STABLE <dev-MOODLE_39_STABLE

Fix Suggestion:

Update to version dev-MOODLE_39_STABLE

moodle/moodle (PHP):

Affected version(s) >=v3.3.0-rc3 <v3.3.8

Fix Suggestion:

Update to version v3.3.8

moodle/moodle (PHP):

Affected version(s) >=v3.5.8 <v3.6.0-beta

Fix Suggestion:

Update to version v3.6.0-beta

moodle/moodle (PHP):

Affected version(s) >=v3.7.3 <v3.7.8

Fix Suggestion:

Update to version v3.7.8

moodle/moodle (PHP):

Affected version(s) =v3.6.4 <v3.6.5

Fix Suggestion:

Update to version v3.6.5

Related Resources (2)

https://github.com/moodle/moodle/commit/3d3dd827fae6db06f8f2a265ef38cfd5566d0c17

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-40320

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

NONE

CVSS v3

Base Score:

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE