CVE-2021-43558
published 2021-11-22CVE-2021-43558: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site…
PriorityP425medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.84%
53.9th percentile
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| moodle | moodle | <= 3.8.8 | — |
| moodle | moodle | — | — |
| moodle | moodle | >= 3.10.0 < 3.10.8 | 3.10.8 |
| moodle | moodle | >= 3.10.0 < 3.10.8 | 3.10.8 |
| moodle | moodle | >= 3.11.0 < 3.11.4 | 3.11.4 |
| moodle | moodle | >= 3.11.0 < 3.11.4 | 3.11.4 |
| moodle | moodle | >= 3.9.0 < 3.9.11 | 3.9.11 |
| moodle | moodle | >= 3.9.0 < 3.9.11 | 3.9.11 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cross-site Scripting in moodle
osv·2021-11-23
CVE-2021-43558 [MEDIUM] Cross-site Scripting in moodle
Cross-site Scripting in moodle
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
GHSA
Cross-site Scripting in moodle
ghsa·2021-11-23
CVE-2021-43558 [MEDIUM] CWE-79 Cross-site Scripting in moodle
Cross-site Scripting in moodle
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
OSV
CVE-2021-43558: A flaw was found in Moodle in versions 3
osv·2021-11-22·CVSS 6.1
CVE-2021-43558 [MEDIUM] CVE-2021-43558: A flaw was found in Moodle in versions 3
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-11-22
Published