PT-2020-16136 · Moodle · Moodle

Kien Hoang · Published 2020-12-09 · Updated 2024-03-06 · CVE-2020-25627

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.9 through 3.9.1

Description The issue concerns a stored XSS risk due to insufficient sanitizing in the moodlenetprofile user profile field. This poses a risk as it can lead to the execution of malicious scripts stored in the user's profile. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For versions 3.9 through 3.9.1, update to version 3.9.2 to resolve the issue. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MOODLE-2020-25627

CVE-2020-25627

GHSA-MGFP-QCF2-PW3M

Affected Products

Moodle

References · 30

• 🔥 https://github.com/HoangKien1020/CVE-2020-25627 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25627 · Security Note
• https://osv.dev/vulnerability/GHSA-mgfp-qcf2-pw3m · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2020-25627 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=410839 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25627 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25627 · Security Note
• https://github.com/moodle/moodle · Note
• https://t.me/cibsecurity/17595 · Telegram Post
• https://t.me/cibsecurity/17693 · Telegram Post
• https://t.me/cibsecurity/17828 · Telegram Post
• https://t.me/cibsecurity/17615 · Telegram Post
• https://t.me/cibsecurity/17789 · Telegram Post