{"id":"CVE-2021-43560","aliases":["BIT-moodle-2021-43560","EUVD-2022-3872","GHSA-g39c-mccf-rxjv","UBUNTU-CVE-2021-43560"],"status":"published","title":"Moodle Insecure direct object reference (IDOR) in a calendar web service","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01126,"percentile":0.66737,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668","CWE-863"],"published":"2021-11-22T16:00:22Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["3.9.11","3.10.8","3.11.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"moodle","fixed_in":["3.8.9","3.9.11","3.10.8","3.11.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9"},{"fixed":"3.9.11"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10"},{"fixed":"3.10.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11"},{"fixed":"3.11.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"moodle","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.9"},{"introduced":"3.9.0"},{"fixed":"3.9.11"},{"introduced":"3.10.0"},{"fixed":"3.10.8"},{"introduced":"3.11.0"},{"fixed":"3.11.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9"},{"fixed":"3.9.11"}]}],"versions":["v3.9.0","v3.9.0-beta","v3.9.0-rc1","v3.9.0-rc2","v3.9.0-rc3","v3.9.1","v3.9.10","v3.9.2","v3.9.3","v3.9.4","v3.9.5","v3.9.6","v3.9.7","v3.9.8","v3.9.9"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10"},{"fixed":"3.10.8"}]}],"versions":["v3.10.0","v3.10.0-beta","v3.10.0-rc1","v3.10.0-rc2","v3.10.1","v3.10.2","v3.10.3","v3.10.4","v3.10.5","v3.10.6","v3.10.7"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11"},{"fixed":"3.11.4"}]}],"versions":["v3.11.0","v3.11.0-beta","v3.11.0-rc1","v3.11.0-rc2","v3.11.1","v3.11.2","v3.11.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.9+dfsg-1","2.7.10+dfsg-1","2.7.11+dfsg-1","2.7.11+dfsg-2","2.7.12+dfsg-1","3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+dfsg-0ubuntu1","3.0.3+dfsg-0ubuntu1+esm1"]}],"products":[{"vendor":"fedoraproject","product":"extra_packages_for_enterprise_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"moodle","product":"moodle"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021519","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=429100","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43560","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-g39c-mccf-rxjv"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-43560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43560","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-43560","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2021-11-22T16:00:22Z","modified":"2024-08-04T04:03:08.485Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2022-3872","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2021-11-22T16:00:22Z","modified":"2024-08-04T04:03:08Z","updated_at":"2026-11-03T03:24:13.193734Z"}],"ghsa":[{"id":"GHSA-g39c-mccf-rxjv","title":"Moodle Insecure direct object reference (IDOR) in a calendar web service","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2022-05-24T19:21:10Z","modified":"2024-05-03T05:02:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2021-43560","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2021-11-22T16:15:08.337Z","modified":"2026-06-17T04:11:08.223Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863","CWE-668"],"updated_at":"2026-11-02T14:07:01.428028Z"}],"osv":[{"id":"CVE-2021-43560","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2021-11-22T16:15:08.337Z","modified":"2026-10-24T10:30:37.897151183Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-g39c-mccf-rxjv","title":"Moodle Insecure direct object reference (IDOR) in a calendar web service","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2022-05-24T19:21:10Z","modified":"2024-04-23T23:58:39.77162Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"UBUNTU-CVE-2021-43560","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2021-11-22T16:15:00Z","modified":"2026-09-23T18:46:10.335676552Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"BIT-moodle-2021-43560","description":"A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.","status":"published","published":"2024-03-06T11:06:24.505Z","modified":"2026-09-08T08:48:14.66730743Z","updated_at":"2026-11-02T15:28:33.469426Z"}]}}