Search for vulnerabilities
Vulnerability details: VCID-8tt7-tddk-tfcj
Vulnerability ID VCID-8tt7-tddk-tfcj
Aliases CVE-2021-3943
GHSA-8jhp-2gcr-qw96
Summary Moodle vulnerable to RCE via unsafe deserialization A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01195 https://api.first.org/data/v1/epss?cve=CVE-2021-3943
epss 0.01195 https://api.first.org/data/v1/epss?cve=CVE-2021-3943
cvssv3.1 9.8 https://bugzilla.redhat.com/show_bug.cgi?id=2021963
generic_textual CRITICAL https://bugzilla.redhat.com/show_bug.cgi?id=2021963
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-8jhp-2gcr-qw96
cvssv3.1 9.8 https://github.com/moodle/moodle/commit/58e8ad852f9e75c8158e5bee02c273383f7d9865
generic_textual CRITICAL https://github.com/moodle/moodle/commit/58e8ad852f9e75c8158e5bee02c273383f7d9865
cvssv3.1 9.8 https://moodle.org/mod/forum/discuss.php?d=429095
generic_textual CRITICAL https://moodle.org/mod/forum/discuss.php?d=429095
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3943
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2021-3943
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2021-3943
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-3943
https://bugzilla.redhat.com/show_bug.cgi?id=2021963
https://github.com/moodle/moodle/commit/58e8ad852f9e75c8158e5bee02c273383f7d9865
https://moodle.org/mod/forum/discuss.php?d=429095
https://nvd.nist.gov/vuln/detail/CVE-2021-3943
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
GHSA-8jhp-2gcr-qw96 https://github.com/advisories/GHSA-8jhp-2gcr-qw96
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2021963
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/moodle/moodle/commit/58e8ad852f9e75c8158e5bee02c273383f7d9865
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://moodle.org/mod/forum/discuss.php?d=429095
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3943
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3943
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77919
EPSS Score 0.01195
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:19:24.028009+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-8jhp-2gcr-qw96/GHSA-8jhp-2gcr-qw96.json 36.1.3