CVE-2021-32476: High severity moodle vulnerability
Published Mar 11, 2022
·Updated
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle>=3.5.17<3.5.18
3.5.18
composer/moodle/moodle>=3.8<3.8.9
3.8.9
composer/moodle/moodle>=3.9<3.9.7
3.9.7
composer/moodle/moodle>=3.10<3.10.4
3.10.4
Moodle moodle<3.5.18
Moodle moodle>=3.8.0<3.8.9
Moodle moodle>=3.9.0<3.9.7
Moodle moodle>=3.10.0<3.10.4
Remediation
Patch Available
Event History
Mar 11, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Mar 12, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2021-32476?
CVE-2021-32476 is classified as a denial-of-service vulnerability in Moodle.
2
How do I fix CVE-2021-32476?
To fix CVE-2021-32476, upgrade to Moodle version 3.10.4, 3.9.7, 3.8.9, or 3.5.18.
3
Which versions of Moodle are affected by CVE-2021-32476?
Affected versions include Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, and 3.5 to 3.5.17.
4
What causes the vulnerability CVE-2021-32476?
CVE-2021-32476 is caused by the draft files area in Moodle not respecting user file upload limits.
5
Is CVE-2021-32476 fixed in later Moodle releases?
Yes, CVE-2021-32476 is fixed in subsequent releases after the affected versions.