CVE-2019-14827

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-17 · updated 2026-06-17
Weakness: CWE-94

Description

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which could result in script injection in some templates. This affects versions 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions.

Affected products

Moodle: from 3.5.0 through 3.5.7; from 3.6.0 through 3.6.5; from 3.7.0 through 3.7.1

References

https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284
https://moodle.org/mod/forum/discuss.php?d=391030
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62284
https://moodle.org/mod/forum/discuss.php?d=391030

Get alerted when CVE-2019-14827 or the next vulnerability affects your stack