PT-2021-8977 · Moodle+1 · Moodle+1

Andrew Nicols + 1 · Published 2019-09-11 · Updated 2021-06-01 · CVE-2019-14827

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.5 through 3.5.7 Moodle versions 3.6 through 3.6.5 Moodle versions 3.7 through 3.7.1

Description A vulnerability was found where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. This occurred because Mustache helper tags included in template contexts were not being escaped before the context was injected into another Mustache helper, which could result in script injection in some templates.

Recommendations For versions 3.5 through 3.5.7, update to a version later than 3.5.7 to resolve the issue. For versions 3.6 through 3.6.5, update to a version later than 3.6.5 to resolve the issue. For versions 3.7 through 3.7.1, update to a version later than 3.7.1 to resolve the issue. As a temporary workaround, consider restricting the use of recursive rendering in Mustache templates to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2019-2681

ALT-PU-2019-2843

CVE-2019-14827

Affected Products

Alt Linux

Moodle

References · 7

• https://osv.dev/vulnerability/CVE-2019-14827 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-14827 · Security Note
• https://ubuntu.com/security/CVE-2019-14827 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=391030 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14827 · Vendor Advisory
• https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14827 · Security Note