vendor:
Moodle
by:
Vincent666 ibn Winnie
8.8
CVSS
HIGH
Persistent Cross Site Scripting
79
CWE
Product Name: Moodle
Affected Version From: 3.10.3
Affected Version To: 3.10.3
Patch Exists: NO
Related CWE: N/A
CPE: a:moodle:moodle
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Windows 10
2021
Moodle 3.10.3 – ‘label’ Persistent Cross Site Scripting
Moodle 3.10.3 is vulnerable to a persistent cross-site scripting vulnerability. An attacker can exploit this vulnerability by creating a new event in the calendar and inserting malicious code in the 'Field Label' field. The malicious code will be stored in the database and will be executed when the event is opened. The malicious code can be in the form of an image tag with an onerror attribute or an embed tag with a base64 encoded script.
Mitigation:
The user should ensure that no malicious code is inserted in the 'Field Label' field when creating an event in the calendar.
