GitHub Advisoryadvisory · Packagist

GHSA-fm6m-fg23-67jq Moodle Cross-site Scripting vulnerability

MEDIUM Published 2022-09-14 Modified 2022-09-21 Official page ↗
Aliases
CVE-2021-36568
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-09-21

Affected packages

• Packagist moodle/moodle: <= 3.9.7 (no fix yet) • Packagist moodle/moodle: >= 3.10.0, <= 3.10.4 (no fix yet) • Packagist moodle/moodle: >= 3.11.0, < 3.11.10 → fixed in 3.11.10

Description

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.

Related

Alias · CVE (1)

  • CVE-2021-36568 In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References