CVE-2021-43560

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863 CWE-668

Affected software

Vendor	Product	Versions
n/a	moodle	moodle 3.11.4, moodle 3.10.8 and moodle 3.9.11

References

https://bugzilla.redhat.com/show_bug.cgi?id=2021519Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429100Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2021519Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=429100Patch, Vendor Advisory

Timeline

Published: Nov 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435615.4An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extensio CVE-2021-435628.8An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the CVE-2021-435638.8An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled m CVE-2021-435647.5An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect CVE-2021-435657.5The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.CVE-2021-435662.5All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in CVE-2021-435689.8The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows CVE-2021-435699.8The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows at CVE-2021-43575.3The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on t CVE-2021-435709.8The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows atta CVE-2021-435719.8The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows a CVE-2021-435729.8The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signa