Moodle Reflected Cross-Site Scripting Vulnerability in Policy Tool

A reflected cross-site scripting vulnerability has been identified in Moodle's policy tool. The issue arises because the return URL in the policy tool lacks proper sanitization, allowing for the injection of malicious scripts. This vulnerability affects Moodle versions 4.5 prior to 4.5.3, 4.4 prior to 4.4.7, 4.3 prior to 4.3.11, 4.1 prior to 4.1.17, and earlier unsupported versions.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Moodle versions 4.5.4, 4.4.8, 4.3.12, or 4.1.18 to address this vulnerability.