CVE-2021-27131
Description
Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
moodle/moodlePackagist | <= 3.10.1 | — |
Affected products
3- osv-coords2 versions
>= 3.10.1, < 3.10.2+ 1 more
- (no CPE)range: >= 3.10.1, < 3.10.2
- (no CPE)range: <= 3.10.1
Patches
Vulnerability mechanics
Root cause
"Improper input sanitization on the "Header" and "Footer" fields in the Additional HTML Section allows stored XSS."
Attack vector
An attacker who already possesses administrator credentials navigates to Site Administration > Appearance > Additional HTML and injects a JavaScript payload (e.g., `
Affected code
The vulnerability exists in the "Additional HTML Section" of `/admin/settings.php`, specifically the "Header" and "Footer" parameters [ref_id=1]. The code path does not sanitize or neutralize user-controllable input before it is rendered on every page of the application.
What the fix does
No patch is provided in the bundle. The vendor disputes the finding, arguing that the "Additional HTML Section" is intentionally designed to allow administrators to enter unsanitized input such as site-specific JavaScript [ref_id=1]. No remediation guidance is published by the vendor.
Preconditions
- authAttacker must have administrator-level credentials for the Moodle instance
- configThe Moodle version must be 3.10.1
Reproduction
1. Log in to the Moodle instance with administrator credentials. 2. Navigate to Site Administration > Appearance > Additional HTML. 3. Insert `
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.