VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Dec 8, 2020· Updated Jun 17, 2026

CVE-2020-25631

CVE-2020-25631

Description

A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.9, < 3.9.23.9.2
moodle/moodlePackagist
>= 3.8, < 3.8.53.8.5
moodle/moodlePackagist
>= 3.7, < 3.7.83.7.8

Affected products

4
  • Moodle/Moodle2 versions
    cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: >=3.7.0,<3.7.8
    • (no CPE)
  • osv-coords2 versions
    pkg:bitnami/moodlepkg:composer/moodle/moodle
    >= 3.7.0, < 3.7.8+ 1 more
    • (no CPE)range: >= 3.7.0, < 3.7.8
    • (no CPE)range: >= 3.9, < 3.9.2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.