CVE-2021-20279: 
PHP vulnerability analysis and mitigation

CVE-2021-20279 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Moodle's ID number user profile field. The vulnerability affects Moodle versions 3.10 to 3.10.1, 3.9 to 3.9.4, 3.8 to 3.8.7, 3.5 to 3.5.16, and earlier unsupported versions. The issue was addressed with the release of versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17 (Moodle Forum).

The vulnerability stems from insufficient sanitization of the ID number user profile field, which could allow stored XSS attacks. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and a CVSS v2.0 score of 3.5 LOW (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability could allow attackers to execute stored XSS attacks through the ID number user profile field, potentially compromising user data and enabling malicious script execution in users' browsers (Red Hat Bugzilla).

The vulnerability requires an authenticated user with access to modify the ID number profile field. The attack complexity is rated as Low, requiring user interaction for successful exploitation (NVD).

A temporary workaround is available by disabling the ID number field. This can be done by unchecking it in Site admin > Users > User policies > Show user identity. For a permanent fix, administrators should upgrade to the patched versions: 3.10.2, 3.9.5, 3.8.8, or 3.5.17 (Moodle Forum).