CVE-2021-21809

CRITICAL9.1EPSS 72.9%

Moodle command execution vulnerability exists in the default legacy spellchecker plugin

發布日:2022/5/24修改日:2024/4/24

也稱為:GHSA-c7jj-vfmr-j9mjBIT-moodle-2021-21809

描述

A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

受影響套件(2)

Bitnami/moodle>= 3.10.0, < 3.10.1
Packagist/moodle/moodle

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-21809
PATCHhttps://github.com/moodle/moodle
WEBhttp://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html
WEBhttps://talosintelligence.com/vulnerability_reports/TALOS-2021-1277