medium5.3
CVE-2021-43560
Moodle Insecure direct object reference (IDOR) in a calendar web service
Impact
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.9, < 3.9.11 | 3.9.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | through 3.8.8 from 3.9.0 before 3.9.11 from 3.10.0 before 3.10.8 from 3.11.0 before 3.11.4 |
| Fedoraproject | Extra Packages For Enterprise Linux | Version 7.0 |
| Fedoraproject | Fedora | Version 35 |