GitHub Advisoryadvisory · Packagist

GHSA-3jrj-x6cj-97cp Moodle contains CSRF vulnerability

HIGH Published 2022-05-24 Modified 2023-07-11 Official page ↗
Aliases
CVE-2021-43559
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-07-11

Affected packages

• Packagist moodle/moodle: >= 3.11, < 3.11.4 → fixed in 3.11.4 • Packagist moodle/moodle: >= 3.10, < 3.10.8 → fixed in 3.10.8 • Packagist moodle/moodle: >= 3.9, < 3.9.11 → fixed in 3.9.11

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

Related

Alias · CVE (1)

  • CVE-2021-43559 A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References