Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-20281

Good to know:

icon

Date: March 15, 2021

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Language: PHP

Severity Score

Related Resources (10)

https://nvd.nist.gov/vuln/detail/CVE-2021-20281
https://moodle.org/mod/forum/discuss.php?d=419652
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/33d6017287e1835513a3de8edd3fbf7a6a90af9c
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
https://bugzilla.redhat.com/show_bug.cgi?id=1939041
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS
https://www.mend.io/vulnerability-database/CVE-2021-20281

Severity Score

Weakness Type (CWE)

Information Leak / Disclosure

CWE-200

Incorrect Authorization

CWE-863

Top Fix

icon

Upgrade Version

Upgrade to version v3.5.17,v3.8.8,v3.9.5,v3.10.2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us