CVE-2024-33997: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in Moodle's equation editor functionality, tracked as CVE-2024-33997. The vulnerability was discovered in May 2024 and affects Moodle versions 4.0 to 4.3.3, 4.2 to 4.2.6, 4.1 to 4.1.9, and earlier unsupported versions. The issue was reported by Aleksey Solovev from Positive Technologies (Moodle Forum).

The vulnerability stems from insufficient sanitization when opening the equation editor, specifically when editing another user's equation. This security flaw has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring user interaction (NVD).

The vulnerability could allow attackers to execute stored cross-site scripting attacks when users edit equations created by other users. This could potentially lead to unauthorized access to user data and compromise of user sessions (CERT-FR).

The vulnerability requires user interaction and can be exploited when a user attempts to edit an equation created by another user. The risk has been classified as 'Minor' by Moodle's security team (Moodle Forum).

The vulnerability has been fixed in Moodle versions 4.3.4, 4.2.7, and 4.1.10. Users are advised to upgrade to these patched versions to mitigate the risk. The fix involves implementing additional sanitization measures when opening the equation editor (Moodle Forum).