CVE-2021-43560: Moodle Insecure direct object reference (IDOR) in a calendar web service
Summary
CVE-2021-43560: Moodle Insecure direct object reference (IDOR) in a calendar web service. Affects moodle/moodle across 3 version ranges.
>= 3.9, < 3.9.11
>= 3.10, < 3.10.8
>= 3.11, < 3.11.4
Fixed in 3.9.11, 3.10.8 or 3.11.4, depending on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2021-43560 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a range of features including course management, content creation, and collaboration tools. Moodle is widely used and has a large user base. However, a vulnerability has been discovered in Moodle versions 3.9 to 3.11.3, which allows for an insecure direct object reference (IDOR) in a calendar web service.
Vulnerability Detail
The vulnerability in Moodle arises from insufficient capability checks, which enables an attacker to access other users' calendar action events. This means that an unauthorized user can view and potentially modify events on another user's calendar. The impact of this vulnerability can be significant, as it compromises the privacy and integrity of users' calendar data. It could lead to unauthorized access to sensitive information or the manipulation of events, potentially disrupting users' schedules and causing confusion or harm.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9, < 3.9.113.9.11composer require moodle/moodle:3.9.11 -
>= 3.10, < 3.10.83.10.8composer require moodle/moodle:3.10.8 -
>= 3.11, < 3.11.43.11.4composer require moodle/moodle:3.11.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to update Moodle to the patched versions mentioned above.
Conclusion
The IDOR vulnerability in Moodle versions 3.9 to 3.11.3 allows unauthorized access to other users' calendar events, compromising privacy and data integrity. To mitigate this vulnerability, it is crucial to update Moodle to the latest patched versions (3.9.11, 3.10.8, or 3.11.4). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management and delivery.
An insecure direct object reference (IDOR) vulnerability occurs when an application allows unauthorized access to resources by not properly validating user permissions or access controls.
The Moodle IDOR vulnerability allows unauthorized users to access and potentially modify other users' calendar events, compromising privacy and data integrity.
Yes, the Moodle development team has released patched versions (3.9.11, 3.10.8, and 3.11.4) that address the IDOR vulnerability.
To protect your Moodle installation, it is recommended to update to the latest patched version (3.9.11, 3.10.8, or 3.11.4) provided by the Moodle development team.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
