CVE-2021-20283 json
Missing permission check in Moodle
published 2021-03-15 5 y ago modified 2026-09-08 2 mo ago also BIT-moodle-2021-20283 , EUVD-2022-2009 , GHSA-2m72-m5cw-3g9h
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Patch / fix
- packagist moodle/moodle 3.5.17, 3.8.8, 3.9.5, 3.10.2
- bitnami moodle 3.5.17, 3.8.8, 3.9.5, 3.10.2
- moodle moodle 3.5.17, 3.8.8, 3.9.5, 3.10.2
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-20283 updated
moodle: Fetching a user's enrolled courses via web services did not check profile access in each course
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | moodle/moodle | >=3.10.0, <3.10.2 >=3.9.0, <3.9.5 >=3.8.0, <3.8.8 <3.5.17 |
3.10.2 3.9.5 3.8.8 3.5.17 |
| bitnami | moodle | >=3.5.0, <3.5.17 >=3.8.0, <3.8.8 >=3.9.0, <3.9.5 >=3.10.0, <3.10.2 |
3.5.17 3.8.8 3.9.5 3.10.2 |
Affected products
- n/a moodle
Classification
References
-
moodle.org
/mod/forum/discuss.php?d=419654
web, patch, vendor-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
vendor-advisory, web
-
bugzilla.redhat.com
/show_bug.cgi?id=1939051
web, issue-tracking, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-20283
advisory, web
-
github.com
/moodle/moodle
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT
web
Sources
- CVE List CVE-2021-20283
- GitHub Advisory GHSA-2m72-m5cw-3g9h
- NVD CVE-2021-20283
- OSV BIT-moodle-2021-20283
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.