CVE-2021-36568
Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
CVE-2021-36568- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
CVE-2021-36568- Updated
- 2026-11-02
EUVDEUVD-2022-6801 No score
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
EUVD-2022-6801- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fm6m-fg23-67jq
Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.
- Record
GHSA-fm6m-fg23-67jq- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
CVE-2021-36568- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-fm6m-fg23-67jq
Moodle Cross-site Scripting vulnerability
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.
- Record
GHSA-fm6m-fg23-67jq- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-36568
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
UBUNTU-CVE-2021-36568- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2021-36568 No score
In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.
- Record
BIT-moodle-2021-36568- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
through 3.9.7 | None known |
moodle/moodlePackagist |
3.10.0 to 3.10.4 | None known |
moodle/moodlePackagist |
3.11.0 up to 3.11.10 | 3.11.10 |
moodleBitnami |
3.9.7 up to 3.9.8, 3.10.4 up to 3.10.5, 3.11.0 up to 3.11.1 | 3.9.83.10.53.11.1 |
moodle/moodlePackagist |
through 3.9.7, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
None known |
moodle/moodlePackagist |
3.10.0 to 3.10.4, plus listed versions v3.10.0v3.10.1v3.10.2v3.10.3v3.10.4 |
None known |
moodle/moodlePackagist |
3.11.0 up to 3.11.10, plus listed versions v3.11.0v3.11.1v3.11.2v3.11.3v3.11.4 Show 5 moreShow lessv3.11.5v3.11.6v3.11.7v3.11.8v3.11.9 |
3.11.10 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36568 is a medium vulnerability (CVSS 5.4) in Moodle, published September 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in moodle/moodle 3.11.10.
References
drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing
blog.hackingforce.com.br/en/cve-2021-36568
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC
nvd.nist.gov/vuln/detail/CVE-2021-36568
bugzilla.redhat.com/show_bug.cgi?id=2126857
Show 6 moreShow less
github.com/advisories/GHSA-fm6m-fg23-67jq
ubuntu.com/security/CVE-2021-36568
cve.org/CVERecord?id=CVE-2021-36568
Left out here: 205 versions. The JSON record has them.