CVE-2021-40694: Medium severity moodle vulnerability
Published Jan 21, 2022
·Updated
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
Affected Software
6 affected componentsFixes available
composer/moodle/moodle>=3.11<3.11.3
3.11.3
composer/moodle/moodle>=3.10<3.10.7
3.10.7
composer/moodle/moodle>=3.9<3.9.10
3.9.10
Moodle moodle<3.9.10
Moodle moodle>=3.10.0<3.10.7
Moodle moodle>=3.11.0<3.11.3
Event History
Jan 21, 2022
Data Sourced
via Red Hat·08:46 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·06:17 PM
Data Sourced
via MITRE·06:17 PM
DescriptionWeakness
Sep 30, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2021-40694?
CVE-2021-40694 is classified as a medium severity vulnerability impacting the Moodle platform.
2
How do I fix CVE-2021-40694?
To fix CVE-2021-40694, upgrade Moodle to version 3.11.3, 3.10.7, or 3.9.10.
3
What versions of Moodle are affected by CVE-2021-40694?
CVE-2021-40694 affects Moodle versions before 3.11.3, 3.10.7, and 3.9.10.
4
Can site administrators exploit CVE-2021-40694?
Yes, CVE-2021-40694 allows site administrators to read files available to the HTTP server system account.
5
What type of vulnerability is CVE-2021-40694?
CVE-2021-40694 is a vulnerability related to insufficient escaping of the LaTeX preamble in Moodle.