CVE-2021-20283

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-15 · updated 2026-06-17
Weakness: CWE-863

Description

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Affected products

Fedoraproject Fedora: 32, 34
Moodle: from 3.5.0 before 3.5.17; from 3.8.0 before 3.8.8; from 3.9.0 before 3.9.5; from 3.10.0 before 3.10.2 — fixed in 3.10.2, 3.5.17, 3.8.8, 3.9.5

How to fix

Upgrade to a fixed version: Moodle 3.10.2, 3.5.17, 3.8.8, 3.9.5. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1939051
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
https://moodle.org/mod/forum/discuss.php?d=419654
https://bugzilla.redhat.com/show_bug.cgi?id=1939051
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
https://moodle.org/mod/forum/discuss.php?d=419654

Get alerted when CVE-2021-20283 or the next vulnerability affects your stack