CVE-2021-36568

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-36568
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36568.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-36568
Aliases
Downstream
Published
2022-09-13T22:15:08Z
Modified
2026-07-08T05:57:12Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "35"
                },
                {
                    "last_affected": "35"
                },
                {
                    "introduced": "36"
                },
                {
                    "last_affected": "36"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / github.com/moodle/moodle

Affected ranges

Type
GIT
Repo
https://github.com/moodle/moodle
Events
Introduced
270f52bf55acaf121cbae6643a8fa6545d545c3f
Last Affected
94f2d3fc4b974c5c7d500988c56b7ca15f58d7ec
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:moodle:moodle:3.9.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:moodle:moodle:3.10.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:moodle:moodle:3.11.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.9.7"
        },
        {
            "last_affected": "3.9.7"
        },
        {
            "introduced": "3.10.4"
        },
        {
            "last_affected": "3.10.4"
        },
        {
            "introduced": "3.11.0"
        },
        {
            "last_affected": "3.11.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*
3.10.4
3.11.0
3.9.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36568.json"