PT-2022-5149 · Moodle+2 · Moodle+2

Leandro Inacio + 3 · Published 2021-07-13 · Updated 2024-03-06 · CVE-2021-36568

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.9.7 through 3.11.10 Moodle versions 3.10.4

Description The issue is related to the lack of protection for the web page structure in Moodle, allowing a remote attacker to conduct a cross-site scripting (XSS) attack. Specifically, in certain Moodle products, after creating a course, it is possible to add a resource to an arbitrary "Topic", in this case, a "Database" with the type "Text", where the Field name and Field description values are vulnerable to stored XSS.

Recommendations For Moodle versions 3.9.7, update to a version later than 3.9.7. For Moodle versions 3.10.4, update to a version later than 3.10.4. For Moodle versions 3.11.x prior to 3.11.10, update to version 3.11.10 or later. As a temporary workaround, consider restricting access to the "Database" resource with the type "Text" in arbitrary "Topics" until a patch is available. Avoid using the Field name and Field description values in the affected "Database" resource until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-2215

BDU:2022-06406

BIT-MOODLE-2021-36568

CVE-2021-36568

GHSA-FM6M-FG23-67JQ

Affected Products

Alt Linux

Moodle

Red Os

References · 22

• 🔥 https://blog.hackingforce.com.br/en/cve-2021-36568 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36568 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-36568 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36568 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2021-36568 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36568 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06406 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm6m-fg23-67jq · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-cve-2022-40316-cve-2022-40315-cve-2022-40314-cve-2022-40313-cve-20 · Note