cbcvebase.
CVE-2021-20279
published 2021-03-15

CVE-2021-20279: The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

PriorityP425medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
1.00%
59.4th percentile
The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Affected

11 ranges
VendorProductVersion rangeFixed in
fedoraprojectfedora——
fedoraprojectfedora——
moodlemoodle——
moodlemoodle>= 3.10 < 3.10.23.10.2
moodlemoodle>= 3.10.0 < 3.10.23.10.2
moodlemoodle>= 3.5 < 3.5.173.5.17
moodlemoodle>= 3.5.0 < 3.5.173.5.17
moodlemoodle>= 3.8 < 3.8.83.8.8
moodlemoodle>= 3.8.0 < 3.8.83.8.8
moodlemoodle>= 3.9 < 3.9.53.9.5
moodlemoodle>= 3.9.0 < 3.9.53.9.5

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.