VulnerabilityModified

CVE-2021-43559

The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

HIGH 8.8EPSS 0.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.61% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: moodle/moodle · fedoraproject/extra packages for enterprise linux · fedoraproject/fedora
Source: patrick@puiterwijk.org

References

https://bugzilla.redhat.com/show_bug.cgi?id=2021517Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429099Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2021517Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429099Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.