PT-2021-3116 · Moodle+1 · Moodle+1

Strifel · Published 2021-05-10 · Updated 2024-03-06 · CVE-2021-32477

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.10 to 3.10.3

Description The issue is related to insufficient input validation in the virtual learning environment. It may allow a remote attacker to gain unauthorized access to protected information. The last time a user accessed the mobile app is displayed on their profile page, but this information should be restricted to users with the relevant capability, such as site administrators by default.

Recommendations For Moodle versions 3.10 to 3.10.3, restrict access to the user profile page information about the last time a user accessed the mobile app to users with the relevant capability, such as site administrators by default.

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

ALT-PU-2021-1777

BDU:2021-02739

BIT-MOODLE-2021-32477

CVE-2021-32477

GHSA-VRPR-2XXX-G444

Affected Products

Alt Linux

Moodle

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2021-32477 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32477 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2021-32477 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=422313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrpr-2xxx-g444 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32477 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32477 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32477 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02739 · Security Note
• https://github.com/moodle/moodle · Note
• https://redos.red-soft.ru/updatesec · Note
• https://cybersecurity-help.cz/vdb/SB2021051707 · Note
• https://t.me/cvenotify/28116 · Telegram Post