{"id":"CVE-2021-36568","details":"In certain Moodle products after creating a course, it is possible to add in a arbitrary \"Topic\" a resource, in this case a \"Database\" with the type \"Text\" where its values \"Field name\" and \"Field description\" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.","aliases":["BIT-moodle-2021-36568","GHSA-fm6m-fg23-67jq"],"modified":"2026-07-08T05:57:12.903229030Z","published":"2022-09-13T22:15:08.793Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"fedoraproject:fedora","cpes":["cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"35"},{"last_affected":"35"},{"introduced":"36"},{"last_affected":"36"}]}]},"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC/"},{"type":"ADVISORY","url":"https://drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing"},{"type":"EVIDENCE","url":"https://blog.hackingforce.com.br/en/cve-2021-36568/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moodle/moodle","events":[{"introduced":"270f52bf55acaf121cbae6643a8fa6545d545c3f"},{"last_affected":"94f2d3fc4b974c5c7d500988c56b7ca15f58d7ec"}],"database_specific":{"extracted_events":[{"introduced":"3.9.7"},{"last_affected":"3.9.7"},{"introduced":"3.10.4"},{"last_affected":"3.10.4"},{"introduced":"3.11.0"},{"last_affected":"3.11.0"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:moodle:moodle:3.9.7:*:*:*:*:*:*:*","cpe:2.3:a:moodle:moodle:3.10.4:*:*:*:*:*:*:*","cpe:2.3:a:moodle:moodle:3.11.0:*:*:*:*:*:*:*"]}}],"versions":["3.10.4","3.11.0","3.9.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36568.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}