Bug 908086 (CVE-2021-27131)

Summary:	www-apps/moodle: XSS in headers and footers
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	trivial	CC:	blueness, web-apps
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/p4nk4jv/CVEs-Assigned/blob/master/Moodle-3.10.1-CVE-2021-27131.md
Whiteboard:	~4 [??]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-06-09 04:35:39 UTC

CVE-2021-27131 (https://github.com/moodle/moodle):

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer.

No linked upstream report...