CVE-2021-32474: SQL Injection

Q: What is the severity of CVE-2021-32474?

CVE-2021-32474 is rated as a high severity vulnerability due to the potential for SQL injection.

Q: How do I fix CVE-2021-32474?

To fix CVE-2021-32474, update Moodle to version 3.10.4, 3.9.7, 3.8.9, or 3.5.18 or higher.

Q: What versions of Moodle are affected by CVE-2021-32474?

CVE-2021-32474 affects Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions.

Q: What are the exploit capabilities for CVE-2021-32474?

CVE-2021-32474 can be exploited through an XML-RPC call when MNet is enabled and requires site administrator access.

Q: What is the impact of CVE-2021-32474 on Moodle installations?

The impact of CVE-2021-32474 includes potential unauthorized access to the database due to SQL injection vulnerabilities.

Published Mar 11, 2022

Updated

An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

Affected Software

8 affected componentsFixes available

composer/moodle/moodle>=3.5<3.5.18

3.5.18

composer/moodle/moodle>=3.8<3.8.9

3.8.9

composer/moodle/moodle>=3.9<3.9.7

3.9.7

composer/moodle/moodle>=3.10<3.10.4

3.10.4

Moodle moodle<3.5.18

Moodle moodle>=3.8.0<3.8.9

Moodle moodle>=3.9.0<3.9.7

Moodle moodle>=3.10.0<3.10.4

Remediation

Patch Available

https://moodle.org/mod/forum/discuss.php?d=422308

Event History

Mar 11, 2022

CVE Published

via MITRE·05:54 PM

Data Sourced

via MITRE·05:54 PM

DescriptionWeakness

Mar 12, 2022

Advisory Published

via GitHub·12:00 AM

Frequently Asked Questions

What is the severity of CVE-2021-32474?

CVE-2021-32474 is rated as a high severity vulnerability due to the potential for SQL injection.

How do I fix CVE-2021-32474?