PT-2021-3690

CVE-2021-36400

Published

2021-07-13

Updated

2025-03-07

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue is related to errors in processing hypertext links, which can be exploited by a remote attacker to bypass security features. Insufficient capability checks in Moodle allow an attacker to remove other users' calendar URL subscriptions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-276: Incorrect Default Permissions

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Related identifiers

CVE-2021-36400

BDU:2021-03923