Untriaged
Permalink
CVE-2025-67851
6.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): HIGH
- Availability impact (A): LOW
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package moodle-dl
Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data export
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.
References
- https://access.redhat.com/security/cve/CVE-2025-67851 x_refsource_REDHAT vdb-entry
- RHBZ#2423841 issue-tracking x_refsource_REDHAT
- https://moodle.org/mod/forum/discuss.php?d=471301
Affected products
moodle
- <5.1.1
- <5.0.4
- <4.5.8
- <4.1.22
- <4.4.12
Package maintainers
-
@freezeboy freezeboy