CVE-2019-14827: Code Injection
A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14827?
CVE-2019-14827 has been categorized as a medium severity vulnerability due to the potential for JavaScript injection through Mustache templates.
How do I fix CVE-2019-14827?
To fix CVE-2019-14827, upgrade Moodle to versions 3.5.8, 3.6.6, or 3.7.2 or later.
What software versions are affected by CVE-2019-14827?
CVE-2019-14827 affects Moodle versions 3.5.0 to 3.5.7, 3.6.0 to 3.6.5, and 3.7.0 to 3.7.1.
What type of attack does CVE-2019-14827 enable?
CVE-2019-14827 enables attackers to perform JavaScript injection attacks via recursive rendering in Mustache templates.
Is user input safe from CVE-2019-14827?
User input is not safe from CVE-2019-14827, as the vulnerability allows for injection when contexts are improperly escaped.