CVE-2021-20184

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-354

Affected software

VendorProductVersions
n/amoodlemoodle 3.10.1, moodle 3.9.4, moodle 3.8.7

References

Timeline

Published
Jan 28, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201855.3It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,CVE-2021-201865.4It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of CVE-2021-201877.2It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP CVE-2021-201887.0A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. ThCVE-2021-20192.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected arCVE-2021-201908.1A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The higCVE-2021-201915.5A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log featureCVE-2021-201933.3A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to causeCVE-2021-201947.8There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y , CONFIG_BCVE-2021-201959.6A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possiblCVE-2021-201966.5A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commandsCVE-2021-201976.3There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ran