vulnerability
Moodle: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVE-2021-32474)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:S/C:P/I:P/A:P) | Mar 11, 2022 | Mar 21, 2022 | Mar 21, 2022 |
Severity
7
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Published
Mar 11, 2022
Added
Mar 21, 2022
Modified
Mar 21, 2022
Description
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Solution(s)
moodle-upgrade-3_10_4moodle-upgrade-3_5_18moodle-upgrade-3_8_9moodle-upgrade-3_9_7
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.