CVE-2021-20185
CVE-2021-20185
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.
CVSS 5.3 · Medium · EPSS 1.4% · Fix available
- Published
- Updated
Affected products and versions
moodle
- Versions
- moodle 3.10.1, moodle 3.9.4, moodle 3.8.7, moodle 3.5.16: Affected
No fix published
moodle/moodle Packagist
- Versions
- v3.5.0
- v3.5.0-beta
- v3.5.0-rc1
- v3.5.1
- v3.5.10
- v3.5.11
- v3.5.12
- v3.5.13
- v3.5.14
- v3.5.15
- v3.5.2
- v3.5.3
- v3.5.4
- v3.5.5
- v3.5.6
- v3.5.7
- v3.5.8
- v3.5.9
- Affected ranges
- ECOSYSTEM: ≥ 3.5, < 3.5.16
Update to 3.5.16
moodle/moodle Packagist
- Versions
- v3.8.0
- v3.8.0-beta
- v3.8.0-rc1
- v3.8.1
- v3.8.2
- v3.8.3
- v3.8.4
- v3.8.5
- v3.8.6
- Affected ranges
- ECOSYSTEM: ≥ 3.8, < 3.8.7
Update to 3.8.7
moodle/moodle Packagist
- Versions
- v3.9.0
- v3.9.0-beta
- v3.9.0-rc1
- v3.9.0-rc2
- v3.9.0-rc3
- v3.9.1
- v3.9.2
- v3.9.3
- Affected ranges
- ECOSYSTEM: ≥ 3.9, < 3.9.4
Update to 3.9.4
moodle/moodle Packagist
- Versions
- v3.10.0
- v3.10.0-beta
- v3.10.0-rc1
- v3.10.0-rc2
- Affected ranges
- ECOSYSTEM: ≥ 3.10, < 3.10.1
Update to 3.10.1
moodle Ubuntu:Pro:16.04:LTS
- Versions
- 2.7.9+dfsg-1
- 2.7.10+dfsg-1
- 2.7.11+dfsg-1
- 2.7.11+dfsg-2
- 2.7.12+dfsg-1
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
moodle Ubuntu:Pro:18.04:LTS
- Versions
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published