CVE-2021-36397: Moodle - Insufficient Capability Checks in Message Deletion
Summary
CVE-2021-36397: In Moodle, insufficient capability checks meant message deletions were not limited to the current user. Affects moodle across 3 version ranges.
< 3.9.8
>= 3.10.0, < 3.10.5
>= 3.11.0, < 3.11.1
Fixed in 3.9.8, 3.10.5 or 3.11.1, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-36397 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and delivering online courses, managing student enrollment, and facilitating communication between teachers and students. Moodle is widely adopted due to its flexibility, extensibility, and robust feature set. However, a vulnerability has been identified in Moodle that allows unauthorized users to delete messages without proper capability checks.
Vulnerability Detail
The vulnerability (CVE-2021-36397) in Moodle arises from insufficient capability checks during message deletions. This means that any user, regardless of their privileges, can delete messages within the system. This could lead to unauthorized removal of important communication, loss of data, or disruption of the learning process. The vulnerability affects versions 3.9.8, 3.10.0 to 3.10.5, and 3.11.0 to 3.11.1 of Moodle.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.83.9.8 -
>= 3.10.0, < 3.10.53.10.5 -
>= 3.11.0, < 3.11.13.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict message deletion capabilities to trusted users only. This can be achieved by modifying the permissions settings within Moodle to limit the ability to delete messages. However, this workaround should be considered temporary, and upgrading to the patched versions is strongly advised.
Conclusion
The vulnerability in Moodle that allows unauthorized message deletions can be mitigated by upgrading to the latest patched versions. Administrators can also implement a temporary workaround by restricting message deletion capabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and communication.
The vulnerability allows unauthorized users to delete messages within Moodle, potentially leading to data loss or disruption of the learning process.
Versions 3.9.8, 3.10.0 to 3.10.5, and 3.11.0 to 3.11.1 of Moodle are affected by this vulnerability.
To fix this vulnerability, upgrade to the latest patched versions of Moodle (3.9.8, 3.10.5, or 3.11.1).
As a temporary workaround, administrators can restrict message deletion capabilities to trusted users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
