Description
Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug."
Remediation
References
Related Vulnerabilities
WordPress 4.3.x Possible SQL Injection Vulnerability (4.3 - 4.3.12)
WordPress Plugin Simple Business Directory with Maps PHP Object Injection (3.6.0)
OpenSSL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3193)
Joomla! Core 3.9.x Information Disclosure (3.9.0 - 3.9.22)
MyBB Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-9403)