GHSA-g39c-mccf-rxjv
Moodle Insecure direct object reference (IDOR) in a calendar web service
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-43560
- Alias
- BIT-moodle-2021-43560
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.9, fixed 3.9.11 |
| Packagist · moodle/moodle | introduced 3.10, fixed 3.10.8 |
| Packagist · moodle/moodle | introduced 3.11, fixed 3.11.4 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2021-43560 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2021519 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=429100 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |