Vulnerability · Published Mar 11, 2022 · Assigned by redhat
CVE-2021-32473
Medium 5.3
In plain English
A medium-severity information exposure in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 3.5.18 | GHSA-wx87-h539-4775 |
| Packagist | moodle/moodle | 3.8.9 | GHSA-wx87-h539-4775 |
| Packagist | moodle/moodle | 3.9.7 | GHSA-wx87-h539-4775 |
| Packagist | moodle/moodle | 3.10.4 | GHSA-wx87-h539-4775 |
Affected products (as reported)
Weakness: CWE-200
References
- https://moodle.org/mod/forum/discuss.php?d=422307 x_refsource_MISC