CVE-2019-14827
N/A
N/A
Summary
A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | Moodle | 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions | affected |
Weaknesses
- CWE-94: CWE-94
ADP Enrichment
CVE Program Container
Additional References
- https://moodle.org/mod/forum/discuss.php?d=391030
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284
References
- https://moodle.org/mod/forum/discuss.php?d=391030
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.