GHSA-fm6m-fg23-67jq
Moodle Cross-site Scripting vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | <= 3.9.7 | no fix listed |
| Packagist | moodle/moodle | >= 3.10.0, <= 3.10.4 | no fix listed |
| Packagist | moodle/moodle | >= 3.11.0, < 3.11.10 | 3.11.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-36568
- https://blog.hackingforce.com.br/en/cve-2021-36568
- https://bugzilla.redhat.com/show_bug.cgi?id=2126857
- https://github.com/moodle/moodle
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC