CVE-2021-36403

MEDIUM

Moodle - XSS

Title source: llm

Description

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.

References (1)

[Patch, Vendor Advisory] https://moodle.org/mod/forum/discuss.php?d=424809

Scores

CVSS v3 5.3

EPSS 0.0041

EPSS Percentile 61.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-912

Status published

Products (2)

moodle/moodle < 3.9.8

moodle/moodle 3.11.0-beta - 3.11.1Packagist

Published Mar 06, 2023

Tracked Since Feb 18, 2026