CVE-2021-43560
EUVD-2022-387222.11.2021, 16:15
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 ≤ 3.8.8 |
| moodle | moodle | 3.9.0 ≤ 𝑥 < 3.9.11 |
| moodle | moodle | 3.10.0 ≤ 𝑥 < 3.10.8 |
| moodle | moodle | 3.11.0 ≤ 𝑥 < 3.11.4 |
| fedoraproject | extra_packages_for_enterprise_linux | 7.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-668 - Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.