PT-2021-2242 · Moodle+1 · Moodle+1

Kstpt · Published 2021-01-11 · Updated 2024-03-06 · CVE-2021-20183

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 3.10.1 Moodle versions prior to 4.0.0-beta

Description The issue is related to insufficient escaping of search queries in certain search inputs, which can lead to reflected Cross-site Scripting (XSS) attacks. This allows a remote attacker to conduct inter-site scripting attacks.

Recommendations For versions prior to 3.10.1, update to version 3.10.1 or later to resolve the issue. For versions prior to 4.0.0-beta, update to version 4.0.0-beta or later to resolve the issue. As a temporary workaround, consider restricting access to search inputs until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1050

ALT-PU-2021-1098

ALT-PU-2022-1641

BDU:2021-01194

BIT-MOODLE-2021-20183

CVE-2021-20183

GHSA-XHFX-RM8Q-C3XV

Affected Products

Alt Linux

Moodle

References · 15

• https://osv.dev/vulnerability/GHSA-xhfx-rm8q-c3xv · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01194 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20183 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=417166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20183 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-20183 · Security Note
• https://ubuntu.com/security/CVE-2021-20183 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20183 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2021-20183 · Vendor Advisory
• https://github.com/moodle/moodle/commit/dc9de7b0d487b73c23c221dc0b8b6e01654921f3 · Note
• https://securitylab.ru/vulnerability/515916.php · Note
• https://cybersecurity-help.cz/vdb/SB2021012515 · Note
• https://t.me/cibsecurity/22801 · Telegram Post
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-70571 · Note
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-70571 · Note