CVE-2021-36401: Moodle - Local Stored XSS Vulnerability
Summary
CVE-2021-36401: In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. Affects moodle across 3 version ranges.
< 3.9.8
>= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
Fixed in 3.9.8, 3.10.5 or 3.11.1, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-36401 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a platform for educators to create interactive and collaborative learning environments. Moodle is widely adopted in educational institutions and organizations worldwide. This vulnerability affects versions 3.9.8, 3.10.5, and 3.11.1 of Moodle.
Vulnerability Detail
The vulnerability identified as CVE-2021-36401 in Moodle is a local stored cross-site scripting (XSS) risk. When exporting ID numbers in HTML data formats, the lack of proper sanitization allows an attacker to inject malicious code that can be executed by other users who view the exported data. This can lead to unauthorized access, data theft, or further exploitation of the affected Moodle instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.83.9.8 -
>= 3.10.0, < 3.10.53.10.5 -
>= 3.11.0, < 3.11.13.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to apply the official patches or upgrade to the fixed versions mentioned above.
Conclusion
The local stored XSS vulnerability in Moodle can pose significant security risks to educational institutions and organizations using the affected versions. It is crucial to apply the recommended fixes or upgrades to ensure the integrity and safety of the Moodle installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses.
A local stored cross-site scripting vulnerability allows an attacker to inject malicious code into a web application, which is then stored and executed by other users who access the affected data.
Versions 3.9.8, 3.10.5, and 3.11.1 of Moodle are affected by this vulnerability.
This vulnerability can lead to unauthorized access, data theft, or further exploitation of the affected Moodle instance.
To fix this vulnerability, it is recommended to upgrade to Moodle 3.9.8, 3.10.5, or 3.11.1, which include the necessary sanitization measures to prevent the local stored XSS risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
