CVE-2021-26812

MEDIUMNuclei

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2021-26812 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMMoodle Jitsi Meet 2.7-2.8.3 - Cross-Site ScriptingCVSS 6.1

Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Update to the latest version of the Moodle Jitsi Meet plugin to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsaceseven (digisec360)
Template tagscve2021cvemoodlejitsixsspluginvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:jitsi:meet:*:*:*:*:*:moodle:*:*
https://github.com/udima-university/moodle-mod_jitsi/issues/67 https://nvd.nist.gov/vuln/detail/CVE-2021-26812 https://github.com/ARPSyndicate/kenzer-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2