CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2021-36396
https://notcve.org/view.php?id=CVE-2021-36396
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. • https://github.com/T0X1Cx/CVE-2021-36396-Exploit https://moodle.org/mod/forum/discuss.php?d=424802 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36401
https://notcve.org/view.php?id=CVE-2021-36401
In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36403
https://notcve.org/view.php?id=CVE-2021-36403
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. • https://moodle.org/mod/forum/discuss.php?d=424809 • CWE-912: Hidden Functionality •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36402
https://notcve.org/view.php?id=CVE-2021-36402
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. • https://moodle.org/mod/forum/discuss.php?d=424808 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36399
https://notcve.org/view.php?id=CVE-2021-36399
In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424805 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •