CVE-2020-25631: XSS
A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25631?
CVE-2020-25631 is classified with a moderate severity level due to the potential for cross-site scripting (XSS).
How do I fix CVE-2020-25631?
To fix CVE-2020-25631, you should upgrade your Moodle installation to version 3.9.2, 3.8.5, or 3.7.8.
What versions of Moodle are affected by CVE-2020-25631?
CVE-2020-25631 affects Moodle versions 3.9 to 3.9.1, 3.8 to 3.8.4, and 3.7 to 3.7.7.
What kind of vulnerability is CVE-2020-25631?
CVE-2020-25631 is a cross-site scripting (XSS) vulnerability that allows JavaScript injection in book chapter titles.
How can I verify if my Moodle version is vulnerable to CVE-2020-25631?
You can verify your Moodle version by checking the version number in your site's admin settings and comparing it with the affected versions.