SQL Injection in Moodle
CVE-2021-32474
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Vulnerability class: SQL Injection
EPSS: 0.009 (56.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Moodle
- N/a Moodle — versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-32474?
- CVE-2021-32474 is a high-severity vulnerability in Moodle, classified under SQL Injection. CVSS score: 7.2/10. Published 2022-03-11.
- How severe is CVE-2021-32474?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2021-32474 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.