CVE-2021-40693: Authentication Bypass in Moodle
Summary
CVE-2021-40693: An authentication bypass risk was identified in the external database authentication functionality, due to a type juggling vulnerability. Affects moodle across 3 version ranges.
< 3.9.10
>= 3.10.0, < 3.10.7
>= 3.11.0, < 3.11.3
Fixed in 3.9.10, 3.10.7 or 3.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-40693 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, and assessment tools. Moodle is vulnerable to an authentication bypass issue in its external database authentication functionality. This vulnerability is caused by a type juggling vulnerability.
Vulnerability Detail
The authentication bypass vulnerability in Moodle allows an attacker to bypass the authentication process by exploiting a type juggling vulnerability. By manipulating the authentication request, an attacker can trick the system into considering the provided credentials as valid, even if they are incorrect. This can lead to unauthorized access to Moodle instances and potential data breaches. The vulnerability has a medium severity rating with a CVSSv3 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.103.9.10 -
>= 3.10.0, < 3.10.73.10.7 -
>= 3.11.0, < 3.11.33.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patches or update to the fixed versions as soon as possible.
Conclusion
The authentication bypass vulnerability in Moodle poses a significant risk to the security of Moodle instances. It is crucial for administrators to update their installations to the fixed versions or apply the provided patches as soon as possible. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and delivering online courses. It provides a wide range of features for educators and learners.
An authentication bypass vulnerability allows an attacker to bypass the authentication process and gain unauthorized access to a system or application.
The type juggling vulnerability in Moodle's external database authentication functionality allows an attacker to manipulate the authentication request and trick the system into considering the provided credentials as valid.
This vulnerability can lead to unauthorized access to Moodle instances, potentially resulting in data breaches and unauthorized actions within the system.
This vulnerability has a medium severity rating with a CVSSv3 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
