CVE-2021-20185

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://moodle.org/mod/forum/discuss.php?d=417168	Patch Vendor Advisory
https://moodle.org/mod/forum/discuss.php?d=417168	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle:3.10.0:::::::*

History

21 Nov 2024, 05:46

Type	Values Removed	Values Added
References	~~() https://moodle.org/mod/forum/discuss.php?d=417168 - Patch, Vendor Advisory~~	() https://moodle.org/mod/forum/discuss.php?d=417168 - Patch, Vendor Advisory

Information

Published : 2021-01-28 20:15

Updated : 2024-11-21 05:46

NVD link : CVE-2021-20185

Mitre link : CVE-2021-20185

CVE.ORG link : CVE-2021-20185

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2021-20185", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-01-28T20:15:13.133", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=417168", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=417168", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages."}, {"lang": "es", "value": "Se encontr\u00f3 en Moodle versiones anteriores a 3.10.1, 3.9.4, 3.8.7 y 3.5.16, que la mensajer\u00eda no impon\u00eda un l\u00edmite de caracteres al enviar mensajes, lo que podr\u00eda resultar en la denegaci\u00f3n de servicio del lado del cliente (navegador) para los usuarios que recib\u00edan mensajes muy grandes"}], "lastModified": "2024-11-21T05:46:05.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23C5022F-A799-4279-8E31-BDAE6C98F87C", "versionEndExcluding": "3.5.16", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C0C5BDE-B2B5-4DE7-BDE0-831F3B56A9CC", "versionEndExcluding": "3.8.7", "versionStartIncluding": "3.8.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47B9548F-912D-4D36-BE31-566EF2812EEA", "versionEndExcluding": "3.9.4", "versionStartIncluding": "3.9.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:3.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B9E83AE-D857-4F96-9466-1361E116D160"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}