CVE-2021-20187: Code Injection
Published Jan 28, 2021
·Updated
It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle>=3.10<3.10.1
3.10.1
composer/moodle/moodle>=3.9<3.9.4
3.9.4
composer/moodle/moodle>=3.8<3.8.7
3.8.7
composer/moodle/moodle>=3.5<3.5.16
3.5.16
Moodle moodle<3.5.16
Moodle moodle>=3.8.0<3.8.7
Moodle moodle>=3.9.0<3.9.4
Moodle moodle=3.10.0
Remediation
Patch Available
Event History
Jan 28, 2021
CVE Published
via MITRE·06:30 PM
Data Sourced
via MITRE·06:30 PM
DescriptionWeakness
May 24, 2022
Advisory Published
via GitHub·05:40 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-20187?
CVE-2021-20187 has a medium severity rating due to the potential for site administrators to execute arbitrary PHP scripts.
2
How do I fix CVE-2021-20187?
To fix CVE-2021-20187, update Moodle to version 3.10.1, 3.9.4, 3.8.7, or 3.5.16 or later.
3
Which versions of Moodle are affected by CVE-2021-20187?
Moodle versions prior to 3.10.1, 3.9.4, 3.8.7, and 3.5.16 are vulnerable to CVE-2021-20187.
4
Can site administrators exploit CVE-2021-20187?
Yes, site administrators can exploit CVE-2021-20187 to execute arbitrary PHP scripts through Shibboleth authentication.
5
Is there a workaround for CVE-2021-20187?
No official workaround exists for CVE-2021-20187; the only mitigation is to upgrade to the patched versions.