Vulnerability · Published Mar 6, 2023 · Assigned by fedora
CVE-2021-36403
Medium 5.3
In plain English
A medium-severity security flaw in Moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 55.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 3.11.1 | GHSA-j9cw-5cpj-9qj5 |
| Packagist | moodle/moodle | 3.10.5 | GHSA-j9cw-5cpj-9qj5 |
| Packagist | moodle/moodle | 3.9.8 | GHSA-j9cw-5cpj-9qj5 |
Affected products (as reported)
Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N