CVE-2024-33997 is a stored XSS vulnerability in Moodle that arises from inadequate sanitization when users open the equation editor to edit equations created by other users. This flaw allows malicious scripts to be stored within the equation content, which could be executed in the context of users viewing or editing the affected equations. The vulnerability affects Moodle versions prior to 4.1.10, versions from 4.2.0 up to but not including 4.2.7, and versions from 4.3.0 up to but not including 4.3.4. The vulnerability has been assigned a medium severity rating, and a patch is available to mitigate the risk.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the equation editor, potentially leading to session hijacking, unauthorized actions, or data exposure within the Moodle environment. However, there are no known exploits in the wild at this time.

A patch is available for this vulnerability. Users should upgrade Moodle to versions 4.1.10 or later, 4.2.7 or later, or 4.3.4 or later to remediate the issue. Applying these updates will ensure that the additional sanitization required to prevent stored XSS when editing another user's equation is in place.