CVE-2021-32475: XSS

Q: What is the severity of CVE-2021-32475?

CVE-2021-32475 is classified as a moderate severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2021-32475?

To remediate CVE-2021-32475, upgrade your Moodle installation to version 3.10.4, 3.9.7, 3.8.9, or 3.5.18.

Q: What are the affected versions in CVE-2021-32475?

Affected versions of Moodle for CVE-2021-32475 include 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, and 3.5 to 3.5.17.

Q: Is CVE-2021-32475 a risk for all Moodle users?

Yes, CVE-2021-32475 poses a risk to all users operating on affected versions of Moodle, particularly those utilizing quiz features.

Q: What type of vulnerability is CVE-2021-32475?

CVE-2021-32475 is a stored cross-site scripting (XSS) vulnerability affecting the display of ID numbers in quiz grading reports.

Published Mar 11, 2022

Updated

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

Affected Software

8 affected componentsFixes available

composer/moodle/moodle>=3.10<3.10.4

3.10.4

composer/moodle/moodle>=3.9<3.9.7

3.9.7

composer/moodle/moodle>=3.8<3.8.9

3.8.9

composer/moodle/moodle>=3.5<3.5.18

3.5.18

Moodle moodle<3.5.18

Moodle moodle>=3.8.0<3.8.9

Moodle moodle>=3.9.0<3.9.7

Moodle moodle>=3.10.0<3.10.4

Remediation

Patch Available

https://moodle.org/mod/forum/discuss.php?d=422309

Event History

Mar 11, 2022

CVE Published

via MITRE·05:54 PM

Data Sourced

via MITRE·05:54 PM

DescriptionWeakness

Mar 12, 2022

Advisory Published

via GitHub·12:00 AM

Frequently Asked Questions

What is the severity of CVE-2021-32475?

CVE-2021-32475 is classified as a moderate severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.

How do I fix CVE-2021-32475?