GHSA-g39c-mccf-rxjv

Moodle Insecure direct object reference (IDOR) in a calendar web service

At a glance

Published: 2022-05-24 19:21 UTC
Updated: 2024-04-23 23:58 UTC
CVE: CVE-2021-43560
Aliases: BIT-moodle-2021-43560
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 3.9, fixed 3.9.11
Packagist · moodle/moodle	introduced 3.10, fixed 3.10.8
Packagist · moodle/moodle	introduced 3.11, fixed 3.11.4

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43560 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2021519 WEB
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=429100 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database