CVE-2021-43558

Published: Nov 22, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

Affected (6)

Products: Moodle: Moodle · Fedoraproject: Extra Packages For Enterprise Linux, Fedora

Moodle

1 product

Moodle

Fedoraproject

2 products

Extra Packages For Enterprise Linux

Fedora

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Up to 3.8.8
Moodle Moodle	From 3.10.0 to 3.10.8
Moodle Moodle	From 3.11.0 to 3.11.4
Moodle Moodle	From 3.9.0 to 3.9.11

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Extra Packages For Enterprise Linux	Version 7.0
Fedoraproject Fedora	Version 35

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=2021515

Source: patrick@puiterwijk.org

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=429097

Source: patrick@puiterwijk.org

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2021515

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=429097

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.