{"id":"BIT-moodle-2021-36568","details":"In certain Moodle products after creating a course, it is possible to add in a arbitrary \"Topic\" a resource, in this case a \"Database\" with the type \"Text\" where its values \"Field name\" and \"Field description\" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.","aliases":["CVE-2021-36568","GHSA-fm6m-fg23-67jq"],"modified":"2026-09-08T08:48:14.925119504Z","published":"2024-03-06T11:08:05.686Z","database_specific":{"severity":"Medium","cpes":["cpe:2.3:a:moodle:moodle:3.10.4:*:*:*:*:*:*:*","cpe:2.3:a:moodle:moodle:3.11.0:*:*:*:*:*:*:*","cpe:2.3:a:moodle:moodle:3.9.7:*:*:*:*:*:*:*","cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"]},"references":[{"type":"ADVISORY","url":"https://blog.hackingforce.com.br/en/cve-2021-36568/"},{"type":"ADVISORY","url":"https://drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC/"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36568"}],"affected":[{"package":{"name":"moodle","ecosystem":"Bitnami","purl":"pkg:bitnami/moodle"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.9.7"},{"fixed":"3.9.8"},{"introduced":"3.10.4"},{"fixed":"3.10.5"},{"introduced":"3.11.0"},{"fixed":"3.11.1"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/moodle/BIT-moodle-2021-36568.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}],"schema_version":"1.9.0"}