PT-2021-2239 · Moodle+1 · Moodle+1
Ata Hakcil
·
Published
2021-01-12
·
Updated
2024-03-06
·
CVE-2021-20186
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Moodle versions prior to 3.10.1
Moodle versions prior to 3.9.4
Moodle versions prior to 3.8.7
Moodle versions prior to 3.5.16
Description
The issue is related to insufficient cleaning of user-provided data in the TeX notation filter of the Moodle virtual learning environment. This can allow a remote attacker to conduct cross-site scripting attacks. The risk of stored XSS exists if the TeX notation filter is enabled and additional sanitizing of TeX content is not performed.
Recommendations
For versions prior to 3.10.1, update to version 3.10.1 or later to resolve the issue.
For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.
For versions prior to 3.8.7, update to version 3.8.7 or later to resolve the issue.
For versions prior to 3.5.16, update to version 3.5.16 or later to resolve the issue.
As a temporary workaround, consider disabling the TeX notation filter until a patch is available.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Moodle