CERT-FR: Multiple Moodle vulnerabilities allow XSS and security policy bypass (CVE-2026-47759, -47761, -47762)

Linha do tempo

1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

   CERT-FR: Multiple Moodle vulnerabilities allow XSS and security policy bypass (CVE-2026-47759, -47761, -47762)

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1318, published 15 October 2026, reports multiple vulnerabilities in Moodle that allow a remote attacker to perform cross-site scripting (XSS) and bypass the security policy. The advisory references CVE-2026-47759, CVE-2026-47761 and CVE-2026-47762, based on two Moodle security bulletins dated 15 October 2026. It does not state whether any flaw is exploited in the wild, and gives no per-CVE technical detail, severity, IOCs or attribution.

   Technical Details

   • Affected: Moodle 5.0.x before 5.0.11, 5.1.x before 5.1.8, 5.2.x before 5.2.4, and versions before 4.5.15.
   • Impact: indirect remote code injection (XSS) and security policy bypass.
   • Vendor bulletins: Moodle security bulletins 482830 and 482831.
   • The advisory does not map individual CVEs to specific impacts.

   Remediation

   • Consult the Moodle security bulletins 482830 and 482831 and upgrade to the fixed versions: 4.5.15, 5.0.11, 5.1.8 or 5.2.4, depending on the branch in use.