Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-43560

CVE-2021-43560: Moodle Insecure direct object reference (IDOR) in a calendar web service

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-43560
GHSA ID
GHSA-g39c-mccf-rxjv
EPSS Score
0.53513%
CWE
CWE-668
Published
5/24/2022
Updated
5/3/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
moodle/moodlecomposer>= 3.9, < 3.9.113.9.11
moodle/moodlecomposer>= 3.10, < 3.10.83.10.8
moodle/moodlecomposer>= 3.11, < 3.11.43.11.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly mentions insufficient capability checks in calendar action event fetching via web services. Moodle's calendar web service endpoints are typically implemented in externallib.php files. The function name follows Moodle's pattern for web service implementations (core_[module]_external class methods). The IDOR occurs because the function likely accepted user IDs as parameters without verifying the requester's right to access those resources, matching CWE-668's exposure of resources to unauthorized spheres. The high confidence comes from the vulnerability context matching standard Moodle architecture and the specific mention of calendar action events in web services.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in Moo*l* in v*rsions *.** to *.**.*, *.** to *.**.*, *.* to *.*.** *n* **rli*r unsupport** v*rsions. Insu**i*i*nt **p**ility ****ks m*** it possi*l* to **t** ot**r us*rs' **l*n**r **tion *v*nts.

Reasoning

T** vuln*r**ility **s*ription *xpli*itly m*ntions insu**i*i*nt **p**ility ****ks in **l*n**r **tion *v*nt **t**in* vi* w** s*rvi**s. Moo*l*'s **l*n**r w** s*rvi** *n*points *r* typi**lly impl*m*nt** in *xt*rn*lli*.p*p *il*s. T** *un*tion n*m* *ollows