CVE-2022-45151: 
PHP vulnerability analysis and mitigation

CVE-2022-45151 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Moodle's social user profile fields. The vulnerability was disclosed on November 21, 2022, affecting Moodle versions 4.0 to 4.0.4 and 3.11 to 3.11.10. The issue exists due to insufficient sanitization of user-supplied data in several "social" user profile fields (Moodle Forum, NVD).

The vulnerability stems from insufficient escaping on some fields in the "social" user profile field type. It has been assigned a CVSS score of 5.0 (Medium) with the vector (AV:N/AC:M/Au:S/C:P/I:P/A:N), indicating that the vulnerability requires network access and some privilege to exploit, with partial impacts on confidentiality and integrity (Rapid7).

When exploited, this vulnerability allows an attacker to inject and execute arbitrary HTML and script code in a user's browser in the context of the vulnerable website. This could lead to potential theft of sensitive information or manipulation of user content (CVE).

The vulnerability has been fixed in Moodle versions 4.0.5 and 3.11.11. As a temporary workaround before applying the patch, administrators can update "social" user profile fields to set their visibility to "not visible". The fix was implemented through a security patch that properly sanitizes user input in social profile fields (Moodle Forum).