CVE-2021-20186: XSS
Published Jan 28, 2021
·Updated
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of TeX content was required to prevent the risk of stored XSS.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle>=3.5<3.5.16
3.5.16
composer/moodle/moodle>=3.8<3.8.7
3.8.7
composer/moodle/moodle>=3.9<3.9.4
3.9.4
composer/moodle/moodle>=3.10<3.10.1
3.10.1
Moodle moodle<3.5.16
Moodle moodle>=3.8.0<3.8.7
Moodle moodle>=3.9.0<3.9.4
Moodle moodle>=3.10.0<3.10.1
Remediation
Patch Available
Event History
Jan 28, 2021
CVE Published
via MITRE·06:38 PM
Data Sourced
via MITRE·06:38 PM
DescriptionWeakness
May 24, 2022
Advisory Published
via GitHub·05:40 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-20186?
CVE-2021-20186 has a medium severity rating due to the risk of stored XSS when the TeX notation filter is enabled.
2
How do I fix CVE-2021-20186?
To fix CVE-2021-20186, upgrade your Moodle installation to versions 3.10.1, 3.9.4, 3.8.7, or 3.5.16 or later.
3
Which software versions are affected by CVE-2021-20186?
CVE-2021-20186 affects Moodle versions prior to 3.10.1, 3.9.4, 3.8.7, and 3.5.16.
4
What type of vulnerability is CVE-2021-20186?
CVE-2021-20186 is categorized as a Cross-Site Scripting (XSS) vulnerability.
5
Can CVE-2021-20186 be exploited remotely?
Yes, CVE-2021-20186 can potentially be exploited remotely if the TeX notation filter is enabled.