CVE-2024-33997

What it actually does

Insufficient input sanitization in the equation editor allows injection of malicious script payloads that are stored and later executed in other users' browsers when editing equations.

Why it matters to the business

Attackers can hijack user sessions, steal credentials, or perform unauthorized actions within the learning platform, potentially compromising course content and user data across installations.

How an attack unfolds

An attacker creates or modifies an equation containing a stored script payload; when another user opens the equation editor to edit that equation the payload executes in their browser context.

How to fix it

Upgrade Moodle to the commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10 or later release that contains the additional sanitization for the equation editor.

How to confirm the fix worked

Confirm the deployed codebase contains commit e8d03fdae4ec30a40cdc535c8e9e95f30604ec10; attempt to save and re-edit a test equation containing known XSS vectors and verify they are neutralized.

Typical attack path

1. Attacker identifies equation-editing functionality and crafts a malicious payload
2. Payload is saved as part of a shared or user-owned equation
3. Victim user opens the equation editor on the affected item
4. Browser executes the injected script under the victim's session

How to detect it

Inspect web server and application logs for unusual requests to the equation editor endpoint; monitor for unexpected script execution or DOM modifications reported by users or browser security tools.

What your security team should do

• Apply the fixed commit or upgrade to a patched Moodle release immediately
• Review and restrict equation-editing permissions to trusted roles where feasible
• Enable content-security-policy headers as a defense-in-depth measure