CVE-2020-25702

2020-11-1916:17:03

CWE-79

redhat

www.cve.org

moodle

content bank

javascript

injection

vulnerability

cve-2020-25702

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

46.9%

JSON

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

CNA Affected

[
  {
    "product": "moodle",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 3.9.3, Fixed in 3.10"
      }
    ]
  }
]