GitHub Advisoryadvisory · Packagist

GHSA-g39c-mccf-rxjv Moodle Insecure direct object reference (IDOR) in a calendar web service

MEDIUM Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2021-43560
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-668
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.9, < 3.9.11 → fixed in 3.9.11 • Packagist moodle/moodle: >= 3.10, < 3.10.8 → fixed in 3.10.8 • Packagist moodle/moodle: >= 3.11, < 3.11.4 → fixed in 3.11.4

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.

Related

Alias · CVE (1)

  • CVE-2021-43560 A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References