GHSA-5x33-h32w-6vr2

ghsaUSosv

Cross site-scripting (XSS) moodle

view advisory published 2021-03-29Licence: CC-BY-4.0

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-25628US	medium6.1	0.98% (62nd)	—	2020-12-08
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupporte…

references

External citations — patches, advisories, analysis.

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69340WEB
https://github.com/moodle/moodle/commit/e8632a4ad0b4da3763cbbe5949594aa449b483bbWEB
https://moodle.org/mod/forum/discuss.php?d=410840WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-25628ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan