CVE-2021-32476

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-324774.3The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capabilCVE-2021-324786.1The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versioCVE-2021-324816.1Cloudera Hue 4.6.0 allows XSS via the type parameter.CVE-2021-324826.1Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.CVE-2021-324835.3Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.CVE-2021-324847.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additioCVE-2021-324857.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additioCVE-2021-324867.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additioCVE-2021-324877.5In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service with no additioCVE-2021-324894.4An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not correctly validate tCVE-2021-324907.8A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to appCVE-2021-324917.8A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to
CVE-2021-32476: High severity, CVSS 7.5 | Vulnix