PT-2021-14791 · Moodle+1 · Moodle+1

Adam Reiser · Published 2021-01-17 · Updated 2024-03-06 · CVE-2021-21809

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle version 3.10

Description A command execution vulnerability exists in the default legacy spellchecker plugin. This issue can be exploited through a specially crafted series of HTTP requests, leading to command execution. An attacker must have administrator privileges to exploit this vulnerability.

Recommendations For Moodle version 3.10, consider disabling the default legacy spellchecker plugin until a patch is available to prevent command execution. Restrict access to administrator privileges to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

OS Command Injection

Weakness Enumeration

CWE-732

CWE-78

Related Identifiers

ALT-PU-2021-1050

ALT-PU-2021-1098

BIT-MOODLE-2021-21809

CVE-2021-21809

GHSA-C7JJ-VFMR-J9MJ

Affected Products

Alt Linux

Moodle

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/moodle_spelling_path_rce.rb · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277 · Exploit
• 🔥 http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21809 · Security Note
• https://ubuntu.com/security/CVE-2021-21809 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21809 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21809 · Security Note
• https://osv.dev/vulnerability/BIT-moodle-2021-21809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7jj-vfmr-j9mj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21809 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://t.me/cibsecurity/25663 · Telegram Post
• https://t.me/cvenotify/16855 · Telegram Post