CVE-2021-20280

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/amoodleFixed in 3.10.2, 3.9.5, 3.8.8, 3.5.17

References

Timeline

Published
Mar 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-202815.3It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.CVE-2021-202825.3When creating a user account, it was possible to verify the account without having access to the verification email link/secret in moodle beCVE-2021-202834.3The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view thatCVE-2021-202845.5A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due CVE-2021-202856.6A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overfloCVE-2021-202862.7A flaw was found in libnbd 1.7.3. An assertion failure in nbd_unlocked_opt_go in ilb/opt.c may lead to denial of service.CVE-2021-202887.2An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn'CVE-2021-202895.3A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the CVE-2021-20299.8Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected arCVE-2021-202906.1An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actiCVE-2021-202916.5A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each lCVE-2021-202926.7There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm i
CVE-2021-20280: Medium severity, CVSS 5.4 | Vulnix