A persistent cross-site scripting vulnerability in Moodle 3.10.3 allows authenticated attackers to execute arbitrary JavaScript, potentially leading to session hijacking or unauthorized actions.

This is a persistent cross-site scripting (XSS) flaw (CWE-79) triggered via the calendar event subtitle field. An authenticated user can inject malicious scripts into the subtitle track label, which executes when other users view the event.

Successful exploitation allows an attacker to execute arbitrary code within the context of a victim's browser session. This could lead to the theft of session cookies, unauthorized access to user accounts, or the redirection of users to malicious websites, resulting in significant data compromise and reputational harm. The CVSS score of 7.2 reflects the high potential for impact within a collaborative learning environment.

Immediate Action: Upgrade Moodle to a secure, supported version that resolves this vulnerability. If an immediate upgrade is not feasible, restrict the ability of users to create calendar events or use media features.

Proactive Monitoring: Review application logs for unusual activity related to the core_calendar_submit_create_update_form endpoint. Monitor for injected script tags within calendar event metadata or unexpected user session behavior.

Compensating Controls: Implement a robust Web Application Firewall (WAF) configured to detect and block XSS patterns in POST requests. Ensure that Content Security Policy (CSP) headers are strictly enforced to limit the execution of unauthorized scripts.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID 49714).

Given the availability of a public proof-of-concept and the nature of persistent XSS, this vulnerability poses a clear risk to the integrity of user sessions within the Moodle platform. Security teams should prioritize patching affected installations to the latest vendor-recommended version to prevent potential account takeovers and unauthorized activity.