GHSA-3jrj-x6cj-97cp

Moodle contains CSRF vulnerability

At a glance

Published: 2022-05-24 19:21 UTC
Updated: 2024-02-16 08:20 UTC
CVE: CVE-2021-43559
Aliases: BIT-moodle-2021-43559
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 3.11, fixed 3.11.4
Packagist · moodle/moodle	introduced 3.10, fixed 3.10.8
Packagist · moodle/moodle	introduced 3.9, fixed 3.9.11

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43559 ADVISORY
https://github.com/moodle/moodle/commit/20d41ebae4eb28269298504c68db511a05ec4969 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2021517 WEB
https://moodle.org/mod/forum/discuss.php?d=429099 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database