A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing malicious data that, when exported and opened in a spreadsheet, allows arbitrary formulas to execute. This can lead to compromised data integrity and unintended operations within the spreadsheet.
Weakness
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Moodle | Moodle | * | 4.1.22 (excluding) |
| Moodle | Moodle | 4.4.0 (including) | 4.4.11 (excluding) |
| Moodle | Moodle | 4.5.0 (including) | 4.5.8 (excluding) |
| Moodle | Moodle | 5.0.0 (including) | 5.0.4 (excluding) |
| Moodle | Moodle | 5.1.0 (including) | 5.1.0 (including) |