CVE-2021-36394
06.03.2023, 21:15
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 < 3.9.8 |
| moodle | moodle | 3.10.0 ≤ 𝑥 < 3.10.5 |
| moodle | moodle | 3.11.0 ≤ 𝑥 < 3.11.1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-384 - Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- CWE-94 - Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.