CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43559
https://notcve.org/view.php?id=CVE-2021-43559
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk. Se encontró un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. La funcionalidad "delete related badge" no incluía la comprobación de tokens necesaria para evitar un riesgo de tipo CSRF • https://bugzilla.redhat.com/show_bug.cgi?id=2021517 https://moodle.org/mod/forum/discuss.php?d=429099 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43558
https://notcve.org/view.php?id=CVE-2021-43558
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk. Se encontró un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. Un parámetro de URL en la herramienta de administración del sitio filetype requería un saneamiento adicional para evitar un riesgo de un ataque de tipo XSS reflejado • https://bugzilla.redhat.com/show_bug.cgi?id=2021515 https://moodle.org/mod/forum/discuss.php?d=429097 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3943
https://notcve.org/view.php?id=CVE-2021-3943
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified. Se ha encontrado un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. Se ha identificado un riesgo de ejecución de código remota cuando se restauran archivos de copia de seguridad • https://bugzilla.redhat.com/show_bug.cgi?id=2021963 https://moodle.org/mod/forum/discuss.php?d=429095 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 5%CPEs: 1EXPL: 3CVE-2021-21809 – Moodle SpellChecker Path Authenticated Remote Command Execution
https://notcve.org/view.php?id=CVE-2021-21809
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities. Se presenta una vulnerabilidad de ejecución de comandos en el plugin default legacy spellchecker en Moodle versión 3.10. Una serie de peticiones HTTP especialmente diseñadas pueden conllevar a una ejecución de comandos. • https://github.com/anldori/CVE-2021-21809 http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-20283
https://notcve.org/view.php?id=CVE-2021-20283
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. El servicio web responsable de obtener los cursos inscritos de otros usuarios no comprobó que el usuario solicitante tuviera permiso para visualizar esa información en cada curso en moodle versiones anteriores a 3.10.2, 3.9.5, 3.8.8, 3.5.17 • https://bugzilla.redhat.com/show_bug.cgi?id=1939051 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT https://moodle.org/mod/forum/discuss.php?d=419654 • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •