Vulnerability · Published Jun 23, 2021 · Assigned by talos
CVE-2021-21809
High 8.2
In plain English
A high-severity security flaw in Moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 24.2% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS 3.0)8.2High
Exploit odds (30 days)24.2%top 2.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Public PoC
Official description
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | no fix listed | GHSA-c7jj-vfmr-j9mj |
| Packagist | moodle/moodle | no fix listed | GHSA-c7jj-vfmr-j9mj |
| Packagist | moodle/moodle | no fix listed | GHSA-c7jj-vfmr-j9mj |