CVE-2021-32474
Moodle Blind SQL injection possible via MNet authentication
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32474- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32474- Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2022-1537 No score
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
EUVD-2022-1537- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvmc-8gmg-ggqr
Moodle Blind SQL injection possible via MNet authentication
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
GHSA-rvmc-8gmg-ggqr- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32474- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-rvmc-8gmg-ggqr
Moodle Blind SQL injection possible via MNet authentication
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
GHSA-rvmc-8gmg-ggqr- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32474
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
UBUNTU-CVE-2021-32474- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-moodle-2021-32474 No score
An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
BIT-moodle-2021-32474- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
3.10 up to 3.10.4 | 3.10.4 |
moodle/moodlePackagist |
3.9 up to 3.9.7 | 3.9.7 |
moodle/moodlePackagist |
3.8 up to 3.8.9 | 3.8.9 |
moodle/moodlePackagist |
3.5 up to 3.5.18 | 3.5.18 |
moodleBitnami |
before 3.5.18, 3.8.0 up to 3.8.9, 3.9.0 up to 3.9.7, 3.10.0 up to 3.10.4 | 3.5.183.8.93.9.73.10.4 |
moodle/moodlePackagist |
3.10 up to 3.10.4, plus listed versions v3.10.0v3.10.0-betav3.10.0-rc1v3.10.0-rc2v3.10.1v3.10.2v3.10.3 |
3.10.4 |
moodle/moodlePackagist |
3.9 up to 3.9.7, plus listed versions v3.9.0v3.9.0-betav3.9.0-rc1v3.9.0-rc2v3.9.0-rc3 Show 6 moreShow lessv3.9.1v3.9.2v3.9.3v3.9.4v3.9.5v3.9.6 |
3.9.7 |
moodle/moodlePackagist |
3.8 up to 3.8.9, plus listed versions v3.8.0v3.8.0-betav3.8.0-rc1v3.8.1v3.8.2 Show 6 moreShow lessv3.8.3v3.8.4v3.8.5v3.8.6v3.8.7v3.8.8 |
3.8.9 |
moodle/moodlePackagist |
3.5 up to 3.5.18, plus listed versions v3.5.0v3.5.0-betav3.5.0-rc1v3.5.1v3.5.10 Show 15 moreShow lessv3.5.11v3.5.12v3.5.13v3.5.14v3.5.15v3.5.16v3.5.17v3.5.2v3.5.3v3.5.4v3.5.5v3.5.6v3.5.7v3.5.8v3.5.9 |
3.5.18 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32474 is a high vulnerability (CVSS 7.2) in Moodle, published March 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in moodle/moodle 3.10.4.