CVE-2021-43559

EUVD-2022-2204
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
moodlemoodle
𝑥
≤ 3.8.8
moodlemoodle
3.9.0 ≤
𝑥
< 3.9.11
moodlemoodle
3.10.0 ≤
𝑥
< 3.10.8
moodlemoodle
3.11.0 ≤
𝑥
< 3.11.4
fedoraprojectextra_packages_for_enterprise_linux
7.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
bionic
needs-triage
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=2021517
https://moodle.org/mod/forum/discuss.php?d=429099
https://bugzilla.redhat.com/show_bug.cgi?id=2021517
https://moodle.org/mod/forum/discuss.php?d=429099