VULNERABILITY INTELLIGENCE

CVE-2021-43559

CVSS score8.8 HIGH

EPSS probability0.62%

CISA KEVNot currently listed

Published2021-11-22

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

Weakness classification

patrick@puiterwijk.org: CWE-352
nvd@nist.gov: CWE-352

Primary references

patrick@puiterwijk.org — Issue Tracking, Third Party Advisory
patrick@puiterwijk.org — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory