CVE-2021-43558: XSS
First published: Tue Nov 09 2021(Updated: )
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle Moodle | <=3.8.8 | |
| Moodle Moodle | >=3.9.0<3.9.11 | |
| Moodle Moodle | >=3.10.0<3.10.8 | |
| Moodle Moodle | >=3.11.0<3.11.4 | |
| Fedoraproject Extra Packages For Enterprise Linux | =7.0 | |
| Fedoraproject Fedora | =35 | |
| redhat/moodle | <3.11.4 | 3.11.4 |
| redhat/moodle 3.10.8 and moodle | <3.9.11 | 3.9.11 |
| <=3.8.8 | ||
| >=3.9.0<3.9.11 | ||
| >=3.10.0<3.10.8 | ||
| >=3.11.0<3.11.4 | ||
| =7.0 | ||
| =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-43558?
CVE-2021-43558 is a vulnerability in Moodle that allows for a reflected XSS risk.
What are the affected versions of Moodle?
Moodle versions 3.11 to 3.11.3, 3.10 to 3.10.7, and 3.9 to 3.9.10, as well as earlier unsupported versions, are affected by CVE-2021-43558.
What is the severity rating of CVE-2021-43558?
The severity rating of CVE-2021-43558 is medium, with a CVSS score of 6.1.
How can I fix the vulnerability?
To fix the vulnerability, it is recommended to update Moodle to versions 3.11.4, 3.10.8, or 3.9.11, depending on the affected version.
Where can I find more information about CVE-2021-43558?
You can find more information about CVE-2021-43558 in the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2021515) and [Moodle forum](https://moodle.org/mod/forum/discuss.php?d=429097).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-43558
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- agent/source
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/3.8.8
- version/moodle moodle/3.9.0
- version/moodle moodle/3.10.0
- version/moodle moodle/3.11.0
- vendor/fedoraproject
- canonical/fedoraproject extra packages for enterprise linux
- version/fedoraproject extra packages for enterprise linux/7.0
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- package-manager/redhat