CVE-2021-43558 — Cross-site Scripting in Moodle

CWE-79 — Cross-site Scripting4 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 63.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MoodleFedoraproject Extra Packages FOR Enterprise LinuxFedoraproject Fedora
Timeline
PublishedNov 22
Latest updateNov 23

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDmoodle/moodle3.9.0 — 3.9.11+3
▶Packagistmoodle/moodle3.11.0 — 3.11.4+2
▶CVEListV5moodle/moodlemoodle 3.11.4, moodle 3.10.8 and moodle 3.9.11

Also affects: Fedora 35

Patches

Patch: moodle.org ↗Patch: moodle.org ↗

🔴Vulnerability Details

3
OSV
Cross-site Scripting in moodle↗2021-11-23
▶
GHSA
Cross-site Scripting in moodle↗2021-11-23
▶
OSV
CVE-2021-43558: A flaw was found in Moodle in versions 3↗2021-11-22
▶