PT-2021-3686 · Moodle+1 · Moodle+1

0Xkasper · Published 2021-07-13 · Updated 2025-03-07 · CVE-2021-36397

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue is related to insufficient capability checks in Moodle, which can allow a remote attacker to bypass security features. Specifically, the problem lies in the fact that message deletions were not limited to the current user, potentially allowing unauthorized access to sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-610

CWE-276

Related Identifiers

ALT-PU-2021-2215

ALT-PU-2022-1641

BDU:2021-03919

BIT-MOODLE-2021-36397

CVE-2021-36397

GHSA-2WMJ-8MQG-R9Q8

Affected Products

Alt Linux

Moodle

References · 17

• https://osv.dev/vulnerability/BIT-moodle-2021-36397 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=424803 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36397 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-36397 · Security Note
• https://osv.dev/vulnerability/GHSA-2wmj-8mqg-r9q8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36397 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03919 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36397 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://t.me/thebugbountyhunter/5998 · Telegram Post
• https://t.me/pentestingnews/18297 · Telegram Post
• https://t.me/cvenotify/45663 · Telegram Post
• https://securitylab.ru/vulnerability/522422.php · Note
• https://cybersecurity-help.cz/vdb/SB2021071911 · Note