CVE-2021-20280: 
PHP vulnerability analysis and mitigation

CVE-2021-20280 is a security vulnerability discovered in Moodle, affecting versions before 3.10.2, 3.9.5, 3.8.8, and 3.5.17. The vulnerability involves text-based feedback answers that required additional sanitizing to prevent stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) risks (Moodle Forum). The issue was reported by security researchers Holme and Rekter0 and was disclosed on March 15, 2021.

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) (NVD). The vulnerability specifically relates to insufficient sanitization of text-based feedback answers in the Moodle platform, which could lead to both stored XSS and blind SSRF attacks.

The vulnerability could allow attackers to execute stored XSS attacks and perform blind SSRF, potentially leading to unauthorized access to sensitive information and the ability to perform actions on behalf of other users. The severity was rated as 'Serious' by Moodle's security team (Moodle Forum).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. A proof-of-concept exploit has been documented (Packet Storm).

The vulnerability has been fixed in Moodle versions 3.10.2, 3.9.5, 3.8.8, and 3.5.17. Users are advised to upgrade to these or later versions to mitigate the risk (Moodle Forum). The fix involves implementing additional sanitization for text-based feedback answers.