CVE-2021-36394: Code Injection
Published Mar 6, 2023
·Updated
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
Affected Software
6 affected componentsFixes available
Moodle moodle<3.9.8
Moodle moodle>=3.10.0<3.10.5
Moodle moodle>=3.11.0<3.11.1
composer/moodle/moodle<3.9.8
3.9.8
composer/moodle/moodle>=3.10.0-beta<3.10.5
3.10.5
composer/moodle/moodle>=3.11.0-beta<3.11.1
3.11.1
Remediation
Patch Available
Event History
Mar 6, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is CVE-2021-36394?
CVE-2021-36394 is a vulnerability in Moodle where a remote code execution risk was identified in the Shibboleth authentication plugin.
2
What is the severity of CVE-2021-36394?
The severity of CVE-2021-36394 is critical with a CVSS score of 9.8.
3
Which versions of Moodle are affected by CVE-2021-36394?
Moodle versions up to 3.9.8, 3.10.0 to 3.10.5, and 3.11.0 to 3.11.1 are affected by CVE-2021-36394.
4
How can I fix CVE-2021-36394?
To fix CVE-2021-36394, update your Moodle installations to a version higher than 3.9.8, 3.10.5, or 3.11.1, depending on the affected version.
5
Where can I find more information about CVE-2021-36394?
You can find more information about CVE-2021-36394 in the following link: [https://moodle.org/mod/forum/discuss.php?d=424799]