CVE-2023-5541
Moodle: xss risk when using csv grade import method
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Moodle: xss risk when using csv grade import method
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
CVE-2023-5541- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-2845
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
EUVD-2023-2845- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-28gc-4qq5-8q26
Moodle Cross-site Scripting vulnerability
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
GHSA-28gc-4qq5-8q26- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
CVE-2023-5541- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Moodle: xss risk when using csv grade import method
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
CVE-2023-5541- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-28gc-4qq5-8q26
Moodle Cross-site Scripting vulnerability
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
GHSA-28gc-4qq5-8q26- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5541
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
UBUNTU-CVE-2023-5541- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2023-5541 No score
Moodle: xss risk when using csv grade import method
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
- Record
BIT-moodle-2023-5541- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 4.3.0-rc2 | 4.3.0-rc2 |
moodleBitnami |
3.9.0 up to 3.9.24, 3.11.0 up to 3.11.17, 4.0.0 up to 4.0.11, 4.1.0 up to 4.1.6, 4.2.0 up to 4.2.3 | 3.9.243.11.174.0.114.1.64.2.3 |
moodle/moodlePackagist |
before 4.3.0-rc2, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
4.3.0-rc2 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5541 is a low vulnerability (CVSS 3.3) in Moodle, published November 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in moodle/moodle 4.3.0-rc2.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79426
bugzilla.redhat.com/show_bug.cgi?id=2243437
moodle.org/mod/forum/discuss.php?d=451582
nvd.nist.gov/vuln/detail/CVE-2023-5541
github.com/moodle/moodle/commit/f5f6ce375e37da902afb043c6b506129fc433233
Left out here: 322 versions. The JSON record has them.