Bug 1939033 (CVE-2021-20279)

Summary: CVE-2021-20279 moodle: Stored XSS via ID number user profile field
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: gwync, igor.raits, sergio
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: moodle 3.10.2, moodle 3.9.5, moodle 3.8.8, moodle 3.5.17 Doc Type: ---
Doc Text:
A flaw was found in moodle. The ID number user profile field requires additional sanitizing to prevent a stored XSS risk.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-15 17:25:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1939034, 1939035    
Bug Blocks: 1939056    

Description Pedro Sampaio 2021-03-15 13:47:39 UTC
The ID number user profile field required additional sanitizing to prevent a stored XSS risk.



Comment 1 Pedro Sampaio 2021-03-15 13:47:43 UTC
External References:


Comment 2 Pedro Sampaio 2021-03-15 13:48:12 UTC
Created moodle tracking bugs for this issue:

Affects: epel-all [bug 1939034]
Affects: fedora-all [bug 1939035]

Comment 3 Product Security DevOps Team 2021-03-15 17:25:54 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Comment 5 Eric Christensen 2021-03-16 18:22:52 UTC

Disable the ID number field by unchecking it in Site admin > Users > User policies > Show user identity, until the patch has been applied.