GitHub Advisoryadvisory · Packagist

GHSA-4qxc-qxrp-33cw Moodle denial-of-service risk in the draft files area

HIGH Published 2022-03-12 Modified 2024-04-23 Official page ↗
Aliases
CVE-2021-32476
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.10, < 3.10.4 → fixed in 3.10.4 • Packagist moodle/moodle: >= 3.9, < 3.9.7 → fixed in 3.9.7 • Packagist moodle/moodle: >= 3.8, < 3.8.9 → fixed in 3.8.9 • Packagist moodle/moodle: >= 3.5.17, < 3.5.18 → fixed in 3.5.18

Description

A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

Related

Alias · CVE (1)

  • CVE-2021-32476 A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References