CVE-2021-43559

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	moodle	moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11

References

https://bugzilla.redhat.com/show_bug.cgi?id=2021517Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429099Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2021517Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429099Patch, Vendor Advisory

Timeline

Published: Nov 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-43569.8The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, CVE-2021-435605.3A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capabili CVE-2021-435615.4An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extensio CVE-2021-435628.8An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the CVE-2021-435638.8An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled m CVE-2021-435647.5An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect CVE-2021-435657.5The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.CVE-2021-435662.5All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in CVE-2021-435689.8The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows CVE-2021-435699.8The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows at CVE-2021-43575.3The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on t CVE-2021-435709.8The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows atta