CVE-2021-20279

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-20284.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.21 and prior. EaCVE-2021-202805.4Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8,CVE-2021-202815.3It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.CVE-2021-202825.3When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle beCVE-2021-202834.3The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view thatCVE-2021-202845.5A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due CVE-2021-202856.6A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overfloCVE-2021-202862.7A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.CVE-2021-202887.2An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn'CVE-2021-202895.3A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the CVE-2021-20299.8Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected arCVE-2021-202906.1An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute acti
CVE-2021-20279: Medium severity, CVSS 5.4 | Vulnix