GitHub Advisoryadvisory · Packagist

GHSA-8jhp-2gcr-qw96 Moodle vulnerable to RCE via unsafe deserialization

CRITICAL Published 2021-11-23 Modified 2023-07-11 Official page ↗
Aliases
CVE-2021-3943
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-07-11

Affected packages

• Packagist moodle/moodle: >= 3.11, < 3.11.4 → fixed in 3.11.4 • Packagist moodle/moodle: >= 3.10, < 3.10.8 → fixed in 3.10.8 • Packagist moodle/moodle: >= 3.9, < 3.9.11 → fixed in 3.9.11

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.

Related

Alias · CVE (1)

  • CVE-2021-3943 A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References