GitHub Advisoryadvisory · Packagist

GHSA-c7jj-vfmr-j9mj Moodle command execution vulnerability exists in the default legacy spellchecker plugin

CRITICAL Published 2022-05-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2021-21809
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-732
Reviewed
2024-04-24

Affected packages

• Packagist moodle/moodle: 3.10.0 (no fix yet) • Packagist moodle/moodle: 3.11.2 (no fix yet) • Packagist moodle/moodle: 3.8.0 (no fix yet)

Description

A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

Related

Alias · CVE (1)

  • CVE-2021-21809 A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References