VYPR
← All advisories
High severity7.2NVD Advisory· Published Jan 28, 2021· Updated Jun 17, 2026

CVE-2021-20187

CVE-2021-20187

Description

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 3.5, < 3.5.163.5.16
moodle/moodlePackagist
>= 3.8, < 3.8.73.8.7
moodle/moodlePackagist
>= 3.9, < 3.9.43.9.4
moodle/moodlePackagist
>= 3.10, < 3.10.13.10.1

Affected products

5
  • Moodle/Moodle2 versions
    cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <3.5.16
    • cpe:2.3:a:moodle:moodle:3.10.0:*:*:*:*:*:*:*
  • Moodle/Moodledescription
  • osv-coords2 versions
    pkg:bitnami/moodlepkg:composer/moodle/moodle
    < 3.5.16+ 1 more
    • (no CPE)range: < 3.5.16
    • (no CPE)range: >= 3.5, < 3.5.16

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.