Vulnerability · Published Jan 28, 2021 · Assigned by redhat
CVE-2021-20184
Medium 4.3
In plain English
A medium-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.7%top 45.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 3.8.7 | GHSA-mm73-86f9-5x5c |
| Packagist | moodle/moodle | 3.9.4 | GHSA-mm73-86f9-5x5c |
| Packagist | moodle/moodle | 3.10.1 | GHSA-mm73-86f9-5x5c |
Affected products (as reported)
Weakness: CWE-354
References
- https://moodle.org/mod/forum/discuss.php?d=417167 x_refsource_MISC