Lucene search

GoogleOSV:BIT-MOODLE-2021-20185

HistoryMar 06, 2024 - 11:11 a.m.

BIT-moodle-2021-20185

2024-03-0611:11:15

Google

osv.dev

moodle

messaging

vulnerability

denial of service

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

39.5%

JSON

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side (browser) denial of service for users receiving very large messages.

CPENameOperatorVersion
moodlelt3.8.7
moodlege3.8.0
moodlelt3.5.16
moodlele3.10.0
moodlelt3.9.4
moodlege3.9.0
moodlege3.10.0
moodlege3.5.0

Name	Operator	Version
moodle	lt	3.8.7
moodle	ge	3.8.0
moodle	lt	3.5.16
moodle	le	3.10.0
moodle	lt	3.9.4
moodle	ge	3.9.0
moodle	ge	3.10.0
moodle	ge	3.5.0

References

moodle.org/mod/forum/discuss.php?d=417168

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

39.5%

JSON

Related for OSV:BIT-MOODLE-2021-20185