Description

An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

Remediation

References

CVE-2021-32474

Related Vulnerabilities

WordPress Plugin WPE Indoshipping Multiple Remote File Inclusion Vulnerabilities (2.5.0)

WordPress Plugin Absolute Reviews Cross-Site Request Forgery (1.0.8)

Apache Tomcat Other Vulnerability (CVE-2006-7197)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-7536)

Craft CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-27903)

Severity

High

Classification

CVE-2021-32474 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities