Vulnerability · Published Mar 11, 2022 · Assigned by redhat
CVE-2021-32475
Medium 5.4
In plain English
A medium-severity OS command injection in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)0.6%top 51.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 3.5.18 | GHSA-5wjh-v7c8-wrhx |
| Packagist | moodle/moodle | 3.8.9 | GHSA-5wjh-v7c8-wrhx |
| Packagist | moodle/moodle | 3.9.7 | GHSA-5wjh-v7c8-wrhx |
| Packagist | moodle/moodle | 3.10.4 | GHSA-5wjh-v7c8-wrhx |
Affected products (as reported)
Weakness: CWE-78
References
- https://moodle.org/mod/forum/discuss.php?d=422309 x_refsource_MISC