CVE-2021-3943

CRITICAL

Moodle 3.9.0-3.9.9, 3.11.0-3.11.3 - Remote Code Execution via Backup File Restoration

Title source: llm

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.

References (2)

Core 2

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=2021963

Patch, Vendor Advisory x_refsource_misc

https://moodle.org/mod/forum/discuss.php?d=429095

Scores

CVSS v3 9.8

EPSS 0.0119

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (2)

moodle/moodle 3.11 - 3.11.4Packagist

moodle/moodle 3.9.0 - 3.9.10

Published Nov 22, 2021

Tracked Since Feb 18, 2026