CVSS: 10.0EPSS: 23%CPEs: 3EXPL: 2CVE-2021-36393 – Moodle 3.10.1 SQL Injection
https://notcve.org/view.php?id=CVE-2021-36393
06 Mar 2023 — In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. Moodle version 3.10.1 suffers from a remote time-based SQL injection vulnerability. • https://packetstorm.news/files/id/178051 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 20%CPEs: 3EXPL: 2CVE-2021-36394
https://notcve.org/view.php?id=CVE-2021-36394
06 Mar 2023 — In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. • https://github.com/dinhbaouit/CVE-2021-36394 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-384: Session Fixation •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36395
https://notcve.org/view.php?id=CVE-2021-36395
06 Mar 2023 — In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. • https://moodle.org/mod/forum/discuss.php?d=424801 • CWE-400: Uncontrolled Resource Consumption CWE-674: Uncontrolled Recursion •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-36396
https://notcve.org/view.php?id=CVE-2021-36396
06 Mar 2023 — In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk. • https://github.com/T0X1Cx/CVE-2021-36396-Exploit • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36397
https://notcve.org/view.php?id=CVE-2021-36397
06 Mar 2023 — In Moodle, insufficient capability checks meant message deletions were not limited to the current user. • https://moodle.org/mod/forum/discuss.php?d=424803 • CWE-276: Incorrect Default Permissions •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36400
https://notcve.org/view.php?id=CVE-2021-36400
06 Mar 2023 — In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. • https://moodle.org/mod/forum/discuss.php?d=424806 • CWE-276: Incorrect Default Permissions CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36401
https://notcve.org/view.php?id=CVE-2021-36401
06 Mar 2023 — In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. • https://moodle.org/mod/forum/discuss.php?d=424807 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36402
https://notcve.org/view.php?id=CVE-2021-36402
06 Mar 2023 — In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. • https://moodle.org/mod/forum/discuss.php?d=424808 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36403
https://notcve.org/view.php?id=CVE-2021-36403
06 Mar 2023 — In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk. • https://moodle.org/mod/forum/discuss.php?d=424809 • CWE-912: Hidden Functionality •
CVSS: 9.4EPSS: 0%CPEs: 7EXPL: 0CVE-2022-45152
https://notcve.org/view.php?id=CVE-2022-45152
25 Nov 2022 — A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71920 • CWE-918: Server-Side Request Forgery (SSRF) •