GHSA-3jrj-x6cj-97cp
Moodle contains CSRF vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-43559
- Alias
- BIT-moodle-2021-43559
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.11, fixed 3.11.4 |
| Packagist · moodle/moodle | introduced 3.10, fixed 3.10.8 |
| Packagist · moodle/moodle | introduced 3.9, fixed 3.9.11 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2021-43559 ADVISORY
- https://github.com/moodle/moodle/commit/20d41ebae4eb28269298504c68db511a05ec4969 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2021517 WEB
- https://moodle.org/mod/forum/discuss.php?d=429099 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |