CVE-2024-28593: n/a
CVE-2024-28593 is a medium severity vulnerability in the Chat activity of Moodle 4.3.3 that allows students to insert potentially unwanted HTML elements such as <a> or <img>, or other HTML content that can degrade performance. The Moodle vendor documentation acknowledges that users can insert HTML in chat messages and notes that the Chat feature is planned to be removed from standard Moodle.
AI Analysis
Technical Summary
The vulnerability in Moodle 4.3.3's Chat activity permits students to embed HTML anchor (<a>) or image (<img>) elements or other HTML content within chat messages. This capability can lead to performance degradation of the chat feature. The vendor's documentation confirms that HTML usage in chat is supported for inserting images, sounds, or styled text. The Chat activity is slated for removal in future Moodle releases, indicating a potential deprecation path rather than an immediate fix.
Potential Impact
An attacker or student user can insert HTML elements that may degrade the performance of the Moodle Chat activity. The confidentiality and integrity impacts are low, with no direct availability impact reported. The vulnerability does not appear to allow privilege escalation or remote code execution. There are no known exploits in the wild.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Since the Moodle vendor plans to remove the Chat activity from standard Moodle, users should consider disabling or removing the Chat feature to mitigate risk. Monitor vendor advisories for updates regarding the removal timeline or any interim mitigations.
CVE-2024-28593: n/a
Description
CVE-2024-28593 is a medium severity vulnerability in the Chat activity of Moodle 4.3.3 that allows students to insert potentially unwanted HTML elements such as <a> or <img>, or other HTML content that can degrade performance. The Moodle vendor documentation acknowledges that users can insert HTML in chat messages and notes that the Chat feature is planned to be removed from standard Moodle.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Moodle 4.3.3's Chat activity permits students to embed HTML anchor (<a>) or image (<img>) elements or other HTML content within chat messages. This capability can lead to performance degradation of the chat feature. The vendor's documentation confirms that HTML usage in chat is supported for inserting images, sounds, or styled text. The Chat activity is slated for removal in future Moodle releases, indicating a potential deprecation path rather than an immediate fix.
Potential Impact
An attacker or student user can insert HTML elements that may degrade the performance of the Moodle Chat activity. The confidentiality and integrity impacts are low, with no direct availability impact reported. The vulnerability does not appear to allow privilege escalation or remote code execution. There are no known exploits in the wild.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Since the Moodle vendor plans to remove the Chat activity from standard Moodle, users should consider disabling or removing the Chat feature to mitigate risk. Monitor vendor advisories for updates regarding the removal timeline or any interim mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2024-03-08T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d95b7ef31ef0b588e28
Added to database: 02/25/2026, 21:45:57 UTC
Last enriched: 09/08/2026, 13:45:21 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.