CVE-2021-36392: Moodle SQL Injection vulnerability
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.10.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.1
Event History
Frequently Asked Questions
What is CVE-2021-36392?
CVE-2021-36392 is an SQL injection vulnerability identified in the library fetching a user's enrolled courses in Moodle.
What is the severity of CVE-2021-36392?
The severity of CVE-2021-36392 is critical with a CVSS score of 9.8.
Which versions of Moodle are affected by CVE-2021-36392?
Moodle versions 3.9.8, 3.10.0 to 3.10.5, and 3.11.0 to 3.11.1 are affected by CVE-2021-36392.
How can I fix CVE-2021-36392?
To fix CVE-2021-36392, it is recommended to upgrade your Moodle installation to a version that includes the necessary security patches.
Where can I find more information about CVE-2021-36392?
You can find more information about CVE-2021-36392 in the Moodle community forums at [https://moodle.org/mod/forum/discuss.php?d=424797](https://moodle.org/mod/forum/discuss.php?d=424797).