A Cross-Site Scripting vulnerability in Moodle allows authenticated attackers to execute malicious scripts in the browsers of other users, potentially leading to unauthorized actions or data theft.

This is a stored Cross-Site Scripting (CWE-79) vulnerability occurring in the formula editor's arithmetic expression fields. The flaw requires an authenticated user with low-level privileges to inject malicious input, which subsequently executes when the payload is rendered in the browsers of other users.

The vulnerability carries a CVSS score of 7.3, reflecting a high risk due to the potential for total impact on confidentiality and integrity. Successful exploitation could allow an attacker to hijack user sessions, perform unauthorized administrative actions, or exfiltrate sensitive data from the Moodle platform. This poses a significant threat to the security and trust of educational or organizational environments relying on the software.

Immediate Action: Update Moodle to the latest patched versions: 4.1.22, 4.4.12, 4.5.8, 5.0.4, or 5.1.1, as specified in the vendor security advisory.

Proactive Monitoring: Review web server and application logs for suspicious activity related to the formula editor or unusual input patterns in arithmetic expression fields.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious XSS payloads targeting the application.

Public Exploit Available: No

Given the potential for session compromise and unauthorized data access, administrators should prioritize applying the provided security patches across all affected Moodle instances. Ensuring software is updated to the specified versions is the only definitive way to remediate this vulnerability and protect the user base from potential XSS-based attacks.