Bug 870040 (CVE-2021-36568)

Summary:	www-apps/moodle: XSS via crafted topic fields
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	blueness, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://blog.hackingforce.com.br/en/cve-2021-36568/
Whiteboard:	B4 [??]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-09-14 00:56:41 UTC

CVE-2021-36568:

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.

No information about remediation at URL, and the other reference 404's for me:

https://drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing

Comment 1 John Helmert III archtester

2022-09-26 14:57:31 UTC

These researchers at URL have a Portugese-language dominated Discord server, trying to get through to them..

Comment 2 John Helmert III archtester

2022-11-30 00:50:23 UTC

RedHat says this doesn't affect any of their commercially supported products:

https://bugzilla.redhat.com/show_bug.cgi?id=2126857