CVE-2021-20184:
Moodle Grade information disclosure in grade's external fetch functions
4.3
Basic Information
PHPTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.8, < 3.8.7 | 3.8.7 |
| moodle/moodle | composer | >= 3.9, < 3.9.4 | 3.9.4 |
| moodle/moodle | composer | >= 3.10, < 3.10.1 | 3.10.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly mentions insufficient capability checks in grade-related web services. Moodle's grade external API (core_grades_external class in grade/externallib.php) contains the primary functions for grade retrieval via web services. The get_grades function is the main entry point for grade fetching operations and would require capability checks to prevent unauthorized access. The CWE-354 mapping (Improper Validation of Integrity Check Value) aligns with missing authorization validation. While commit details aren't available, the combination of 1) vulnerability context (grade disclosure via web services), 2) standard Moodle architecture patterns for external APIs, and 3) the explicit mention of 'external fetch functions' in multiple sources provides high confidence in this identification.