CVE-2021-36394 : In Moodle, a remote code execution risk was identified in the Shibboleth authent

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

Published 2023-03-06 21:15:10

Updated 2023-03-13 15:21:20

Source Fedora Project

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2021-36394

Moodle » Moodle
Versions from including (>=) 3.10.0 and before (<) 3.10.5
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle
Versions before (<) 3.9.8
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle
Versions from including (>=) 3.11.0 and before (<) 3.11.1
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.46%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Assigned by: patrick@puiterwijk.org (Secondary)

https://moodle.org/mod/forum/discuss.php?d=424799

Moodle.org: MSA-21-0022: Remote code execution risk when Shibboleth authentication is enabled
Patch;Vendor Advisory

Jump to