Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-40692

CVE-2021-40692: Moodle Incorrect Authorization

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-40692
GHSA ID
GHSA-wr6q-xv23-rfq9
EPSS Score
0.33384%
CWE
CWE-863
Published
9/30/2022
Updated
4/23/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer>= 3.11, < 3.11.33.11.3
moodle/moodlecomposer>= 3.10, < 3.10.73.10.7
moodle/moodlecomposer>= 3.9, < 3.9.103.9.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insufficient authorization checks when retrieving course participants. Moodle's user management system relies on course context validation and capability checks ('moodle/course:viewparticipants'). The primary function for participant retrieval (core_user::get_participants) would be the logical location for missing context validation, while enrollment functions like enrol_get_my_courses might contribute to improper course ID selection. The high confidence in core_user::get_participants aligns with the vulnerability's core mechanism described in advisories.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Insu**i*i*nt **p**ility ****ks m*** it possi*l* *or t*****rs to *ownlo** us*rs outsi** o* t**ir *ours*s.

Reasoning

T** vuln*r**ility st*ms *rom insu**i*i*nt *ut*oriz*tion ****ks w**n r*tri*vin* *ours* p*rti*ip*nts. Moo*l*'s us*r m*n***m*nt syst*m r*li*s on *ours* *ont*xt v*li**tion *n* **p**ility ****ks ('moo*l*/*ours*:vi*wp*rti*ip*nts'). T** prim*ry *un*tion *or