Vulnerability · Published Jan 21, 2022 · Assigned by redhat

CVE-2021-40691

Medium 4.3

In plain English

A medium-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.7%top 46.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A session hijack risk was identified in the Shibboleth authentication plugin.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	moodle/moodle	3.9.10	GHSA-92vh-mr2w-j2cr
Packagist	moodle/moodle	3.10.7	GHSA-92vh-mr2w-j2cr
Packagist	moodle/moodle	3.11.3	GHSA-92vh-mr2w-j2cr

Affected products (as reported)

Vendor	Product	Versions
n/a	moodle	3.11 to 3.11.2, 3.10 to 3.10.6, 3.9 to 3.9.9 and earlier unsupported versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=2043411 x_refsource_MISC