CVE-2020-25631CWE-79

A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which…

published December 8, 2020

CVSS
—
EPSS
1%
Percentile
60.4
In the wild
Unconfirmed
What it is

A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00934 · 60.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-12-08T00:10Z
EPSS history
Timeline
  • 08 DEC 00:10Z
    A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which…
    cvelistv5