high8.8
CVE-2021-43559
Moodle contains CSRF vulnerability
Impact
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.11, <= 3.11.3 | 3.11.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | through 3.8.8 from 3.9.0 before 3.9.11 from 3.10.0 before 3.10.8 from 3.11.0 before 3.11.4 |
| Fedoraproject | Extra Packages For Enterprise Linux | Version 7.0 |
| Fedoraproject | Fedora | Version 35 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2021517
- https://moodle.org/mod/forum/discuss.php?d=429099
- https://github.com/advisories/GHSA-3jrj-x6cj-97cp
- https://nvd.nist.gov/vuln/detail/CVE-2021-43559
- https://github.com/moodle/moodle/commit/20d41ebae4eb28269298504c68db511a05ec4969