CVE-2021-32476
Moodle denial-of-service risk in the draft files area
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32476- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-770
- Updated
- 2026-11-02
CVE List No score
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32476- Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2022-1313 No score
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
EUVD-2022-1313- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qxc-qxrp-33cw
Moodle denial-of-service risk in the draft files area
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
GHSA-4qxc-qxrp-33cw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSV
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
CVE-2021-32476- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-4qxc-qxrp-33cw
Moodle denial-of-service risk in the draft files area
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
GHSA-4qxc-qxrp-33cw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32476
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
UBUNTU-CVE-2021-32476- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-moodle-2021-32476 No score
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Record
BIT-moodle-2021-32476- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
3.10 up to 3.10.4 | 3.10.4 |
moodle/moodlePackagist |
3.9 up to 3.9.7 | 3.9.7 |
moodle/moodlePackagist |
3.8 up to 3.8.9 | 3.8.9 |
moodle/moodlePackagist |
3.5.17 up to 3.5.18 | 3.5.18 |
moodleBitnami |
before 3.5.18, 3.8.0 up to 3.8.9, 3.9.0 up to 3.9.7, 3.10.0 up to 3.10.4 | 3.5.183.8.93.9.73.10.4 |
moodle/moodlePackagist |
3.10 up to 3.10.4, plus listed versions v3.10.0v3.10.0-betav3.10.0-rc1v3.10.0-rc2v3.10.1v3.10.2v3.10.3 |
3.10.4 |
moodle/moodlePackagist |
3.9 up to 3.9.7, plus listed versions v3.9.0v3.9.0-betav3.9.0-rc1v3.9.0-rc2v3.9.0-rc3 Show 6 moreShow lessv3.9.1v3.9.2v3.9.3v3.9.4v3.9.5v3.9.6 |
3.9.7 |
moodle/moodlePackagist |
3.8 up to 3.8.9, plus listed versions v3.8.0v3.8.0-betav3.8.0-rc1v3.8.1v3.8.2 Show 6 moreShow lessv3.8.3v3.8.4v3.8.5v3.8.6v3.8.7v3.8.8 |
3.8.9 |
moodle/moodlePackagist |
3.5.17 up to 3.5.18, plus listed versions v3.5.17 |
3.5.18 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32476 is a high vulnerability (CVSS 7.5) in Moodle, published March 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in moodle/moodle 3.10.4.