CVE-2021-40693: Moodle Type Juggling Vulnerability
Summary
CVE-2021-40693: Moodle type juggling vulnerability. Affects moodle/moodle across 3 version ranges.
>= 3.9, < 3.9.10
>= 3.10, < 3.10.7
>= 3.11, < 3.11.3
Fixed in 3.9.10, 3.10.7 or 3.11.3, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2021-40693 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, quizzes, and other educational content. The vulnerability identified in Moodle is related to its external database authentication functionality, specifically due to a type juggling vulnerability.
Vulnerability Detail
The type juggling vulnerability in Moodle's external database authentication functionality poses an authentication bypass risk. This vulnerability allows an attacker to manipulate the authentication process by exploiting the way PHP handles type comparisons. By providing specially crafted input, an attacker can bypass the authentication mechanism and gain unauthorized access to the Moodle system. This can lead to unauthorized access to sensitive information, tampering with course content, and potential disruption of the learning environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9, < 3.9.103.9.10composer require moodle/moodle:3.9.10 -
>= 3.10, < 3.10.73.10.7composer require moodle/moodle:3.10.7 -
>= 3.11, < 3.11.33.11.3composer require moodle/moodle:3.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update Moodle to the patched versions mentioned above to mitigate the risk.
Conclusion
The Moodle type juggling vulnerability poses an authentication bypass risk in the external database authentication functionality. It is crucial to update Moodle to the patched versions (Moodle 3.9.10, Moodle 3.10.7, or Moodle 3.11.3) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The vulnerability allows an attacker to bypass authentication and gain unauthorized access to the Moodle system, potentially compromising sensitive information and disrupting the learning environment.
To fix this vulnerability, update Moodle to the latest patched versions: Moodle 3.9.10, Moodle 3.10.7, or Moodle 3.11.3.
No specific workaround is provided. Updating to the patched versions is the recommended solution.
For more information, refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-2jxg-mv2m-j4r7/GHSA-2jxg-mv2m-j4r7.json
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
