What is GHSA-3jrj-x6cj-97cp?

GHSA-3jrj-x6cj-97cp is a security advisory published by GitHub Security Advisories with High severity. Moodle contains CSRF vulnerability

Which CVE IDs does GHSA-3jrj-x6cj-97cp cover?

GHSA-3jrj-x6cj-97cp covers the following CVE IDs: CVE-2021-43559. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3jrj-x6cj-97cp?

GHSA-3jrj-x6cj-97cp has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3jrj-x6cj-97cp?

GHSA-3jrj-x6cj-97cp affects 3 products, including: composer/moodle/moodle:\u003e= 3.11, \u003c= 3.11.3; composer/moodle/moodle:\u003e= 3.10, \u003c= 3.10.7; composer/moodle/moodle:\u003e= 3.9, \u003c= 3.9.10.

GHSA-3jrj-x6cj-97cpHighCVSS 8.8

Moodle contains CSRF vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 11, 2023

🔗 CVE IDs covered (1)

CVE-2021-43559 →

📋 Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

🎯 Affected products3

composer/moodle/moodle:>= 3.11, <= 3.11.3
composer/moodle/moodle:>= 3.10, <= 3.10.7
composer/moodle/moodle:>= 3.9, <= 3.9.10

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-43559
https://bugzilla.redhat.com/show_bug.cgi?id=2021517
https://moodle.org/mod/forum/discuss.php?d=429099
https://github.com/moodle/moodle/commit/20d41ebae4eb28269298504c68db511a05ec4969
https://github.com/advisories/GHSA-3jrj-x6cj-97cp