CVE-2020-25627: Moodle stored Cross-site Scripting (XSS)
Published Dec 9, 2020
·Updated
Moodle stored Cross-site Scripting (XSS)
Other sources
The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.
— GitHub
Affected Software
3 affected componentsFixes available
composer/moodle/moodle>=3.9<3.9.2
3.9.2
Moodle Moodle>=3.9.0<3.9.2
composer/moodle/moodle>=3.9, <3.9.2
3.9.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.2 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.9.2
Event History
Dec 9, 2020
CVE Published
via MITRE·12:04 AM
Data Sourced
via MITRE·12:04 AM
DescriptionWeakness
Data Sourced
via NVD·01:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 18, 2021
Exploit Published
via GitHub·10:37 AM
May 24, 2022
Advisory Published
via GitHub·05:35 PM
Data Sourced
via GitHub·05:35 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Packagist·05:35 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-25627?
CVE-2020-25627 has a medium severity rating due to the potential for stored XSS vulnerabilities.
2
How do I fix CVE-2020-25627?
To fix CVE-2020-25627, update Moodle to version 3.9.2 or later.
3
Which versions are affected by CVE-2020-25627?
CVE-2020-25627 affects Moodle versions 3.9 to 3.9.1.
4
What type of vulnerability is CVE-2020-25627?
CVE-2020-25627 is a stored cross-site scripting (XSS) vulnerability.
5
What product does CVE-2020-25627 impact?
CVE-2020-25627 impacts the Moodle learning management system.