p PatchFirst

PatchFirst · Latest vulnerabilities

moodle/moodle vulnerabilities · Page 9

Vulnerabilities published for moodle/moodle in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 437

  8. CVE-2021-32474

    High · CVSS 7.2EPSS 0.93%Fix available

    CVE-2021-32474

    An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.10.4
    • Update to 3.5.18
    • Update to 3.8.9
    • Update to 3.9.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2021-32477

    Medium · CVSS 4.3EPSS 0.74%Fix available

    CVE-2021-32477

    The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.

    moodle/moodlePHP
    • Update to 3.10.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2021-32478

    Medium · CVSS 6.1EPSS 1.13%Public exploitFix available

    CVE-2021-32478

    The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.

    moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.10.4
    • Update to 3.8.9
    • Update to 3.9.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2021-32476

    High · CVSS 7.5EPSS 1.09%Fix available

    CVE-2021-32476

    A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

    moodle/moodle moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.10.4
    • Update to 3.5.18
    • Update to 3.8.9
    • Update to 3.9.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2022-0334

    Medium · CVSS 4.3EPSS 0.71%Fix available

    CVE-2022-0334

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

    moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.10.8
    • Update to 3.11.5
    • Update to 3.9.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2022-0333

    Low · CVSS 3.8EPSS 0.64%Fix available

    CVE-2022-0333

    A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.

    moodle/moodle moodle/moodle moodle/moodlePHP
    • Update to 3.10.8
    • Update to 3.11.5
    • Update to 3.9.11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →