Vulnerability · Published Nov 19, 2020 · Assigned by redhat

CVE-2020-25702

Medium 6.1

In plain English

A medium-severity cross-site scripting in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.3%top 29.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	moodle/moodle	3.9.3	GHSA-pgcp-m69h-p2gr

Affected products (as reported)

Vendor	Product	Versions
n/a	moodle	Fixed in 3.9.3, Fixed in 3.10

Weakness: CWE-79

References

https://bugzilla.redhat.com/show_bug.cgi?id=1895437 x_refsource_MISC
https://moodle.org/mod/forum/discuss.php?d=413940 x_refsource_MISC
FEDORA-2020-304aa2c365 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-db73e37548 vendor-advisory, x_refsource_FEDORA