CVE-2021-27131

MEDIUM5.4EPSS 0.42%

Moodle vulnerable to stored Cross-site Scripting

發布日:2023/5/16修改日:2024/2/16

也稱為:GHSA-w2pm-fr62-jgv4BIT-moodle-2021-27131

描述

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in `/admin/settings.php`. This vulnerability may lead an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer.

受影響套件(2)

Bitnami/moodle>= 3.10.1, < 3.10.2
Packagist/moodle/moodlefrom 0, <= 3.10.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-27131
PATCHhttps://github.com/moodle/moodle
WEBhttps://docs.moodle.org/402/en/Risks
WEBhttps://github.com/p4nk4jv/CVEs-Assigned/blob/master/Moodle-3.10.1-CVE-2021-27131.md