CVE-2020-25702

MEDIUM

Moodle 3.9-3.9.2 - Stored Cross-Site Scripting via Content Bank Item Rename

Title source: llm

Description

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

References (4)

Core 4

Core References

Issue Tracking, Vendor Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=1895437

Vendor Advisory x_refsource_misc

https://moodle.org/mod/forum/discuss.php?d=413940

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B55KXBVAT45MDASJ3EK6VIGQOYGJ4NH6/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NNFCHPPHRJNJROIX6SYMHOC6HMKP3GU/

Scores

CVSS v3 6.1

EPSS 0.0037

EPSS Percentile 58.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (4)

fedoraproject/fedora 32

fedoraproject/fedora 33

moodle/moodle 3.9 - 3.9.3

moodle/moodle 3.9.0 - 3.9.3Packagist

Published Nov 19, 2020

Tracked Since Feb 18, 2026