Bug 2162547 (CVE-2023-23922)

Summary:	CVE-2023-23922 moodle: Reflected XSS risk in blog search
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	Claudebwpfdiaka42, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	moodle 4.1.1, moodle 4.0.6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-02-01 03:55:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2165640, 2165641
Bug Blocks:	2162524

Description Zack Miele 2023-01-19 22:14:44 UTC

Blog search required additional sanitizing to prevent a reflected XSS risk.

Versions affected: 4.1 and 4.0 to 4.0.5
Versions fixed: 4.1.1, 4.0.6

Comment 1 Zack Miele 2023-01-30 16:21:52 UTC

Created moodle tracking bugs for this issue:

Affects: epel-all [bug 2165640]
Affects: fedora-all [bug 2165641]

Comment 2 Product Security DevOps Team 2023-02-01 03:55:52 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Comment 3 Claudeb Henryj 2026-07-14 09:45:59 UTC

Security issues like CVE-2023-23922 are a good reminder that even trusted platforms need regular updates and careful maintenance. Staying informed about vulnerabilities helps reduce risks and keep systems protected. If you're interested in exploring something different online, you can also visit https://plinkochicken.net/.