CVE-2021-36568: XSS
First published: Tue Sep 13 2022(Updated: )
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle Moodle | =3.9.7 | |
| Moodle Moodle | =3.10.4 | |
| Moodle Moodle | =3.11.0 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.hackingforce.com.br/en/cve-2021-36568/
- https://drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW/
Frequently Asked Questions
What is CVE-2021-36568?
CVE-2021-36568 is a vulnerability in certain Moodle products that allows for Cross Site Scripting (XSS) attacks.
Which versions of Moodle are affected by CVE-2021-36568?
Moodle versions 3.9.7, 3.10.4, and 3.11.0 are affected by CVE-2021-36568.
What is the severity of CVE-2021-36568?
CVE-2021-36568 has a severity rating of medium with a score of 5.4.
How can I exploit the vulnerability in CVE-2021-36568?
As a user with access to create a course in Moodle, you can add a resource in an arbitrary topic, specifically a database with the type 'Text', to exploit the Cross Site Scripting (XSS) vulnerability.
How can I mitigate the vulnerability in CVE-2021-36568?
To mitigate CVE-2021-36568, update your Moodle installation to a version that is not affected by the vulnerability.
- collector/nvd-index
- agent/references
- agent/tags
- agent/weakness
- agent/type
- agent/event
- agent/severity
- agent/description
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/3.9.7
- version/moodle moodle/3.10.4
- version/moodle moodle/3.11.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36