CVE-2021-43560
published 2021-11-22CVE-2021-43560: A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.97%
58.1th percentile
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| moodle | moodle | <= 3.8.8 | — |
| moodle | moodle | — | — |
| moodle | moodle | >= 3.10 < 3.10.8 | 3.10.8 |
| moodle | moodle | >= 3.10.0 < 3.10.8 | 3.10.8 |
| moodle | moodle | >= 3.11 < 3.11.4 | 3.11.4 |
| moodle | moodle | >= 3.11.0 < 3.11.4 | 3.11.4 |
| moodle | moodle | >= 3.9 < 3.9.11 | 3.9.11 |
| moodle | moodle | >= 3.9.0 < 3.9.11 | 3.9.11 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Moodle Insecure direct object reference (IDOR) in a calendar web service
osv·2022-05-24
CVE-2021-43560 [MEDIUM] Moodle Insecure direct object reference (IDOR) in a calendar web service
Moodle Insecure direct object reference (IDOR) in a calendar web service
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
GHSA
Moodle Insecure direct object reference (IDOR) in a calendar web service
ghsa·2022-05-24
CVE-2021-43560 [MEDIUM] CWE-668 Moodle Insecure direct object reference (IDOR) in a calendar web service
Moodle Insecure direct object reference (IDOR) in a calendar web service
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
OSV
CVE-2021-43560: A flaw was found in Moodle in versions 3
osv·2021-11-22·CVSS 5.3
CVE-2021-43560 [MEDIUM] CVE-2021-43560: A flaw was found in Moodle in versions 3
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-11-22
Published