CVE-2021-40695: Moodle - Quiz Grade Disclosure
Summary
CVE-2021-40695: It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Affects moodle across 3 version ranges.
>= 3.9.0, < 3.9.10
>= 3.10.0, < 3.10.7
>= 3.11.0, < 3.11.3
Fixed in 3.9.10, 3.10.7 or 3.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2021-40695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used for creating and managing online courses. It provides various features for educators and students, including quizzes and grading functionality. This vulnerability specifically affects the quiz web service in Moodle.
Vulnerability Detail
The vulnerability (CVE-2021-40695) allows students to view their quiz grade before it has been released. This can lead to unauthorized access to sensitive information and potential academic misconduct. The issue arises due to a flaw in the quiz web service implementation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.103.9.10 -
>= 3.10.0, < 3.10.73.10.7 -
>= 3.11.0, < 3.11.33.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the official patches or upgrade to a fixed version of Moodle.
Conclusion
The vulnerability in Moodle's quiz web service allows students to view their quiz grade before it has been released. It is important to upgrade to the patched versions (3.9.10, 3.10.7, or 3.11.3) or any future releases that address this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for online course management.
The vulnerability allows students to view their quiz grade before it has been released, potentially leading to unauthorized access and academic misconduct.
Versions 3.9.0, 3.10.0, and 3.11.0 are affected. The vulnerability has been fixed in versions 3.9.10, 3.10.7, and 3.11.3.
To fix this vulnerability, upgrade to Moodle versions 3.9.10, 3.10.7, or 3.11.3, or any future releases that include the fix.
There is no specific workaround provided. It is recommended to apply the official patches or upgrade to a fixed version of Moodle.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
