CVEvulnerability

CVE-2019-14827

6.1 MEDIUM Published 2021-05-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-05-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-94

Description

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.

Affected configurations

• moodle moodle (>= 3.5.0 <= 3.5.7) • moodle moodle (>= 3.6.0 <= 3.6.5) • moodle moodle (>= 3.7.0 <= 3.7.1)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References