CVE-2021-20187: 
PHP vulnerability analysis and mitigation

CVE-2021-20187 is a security vulnerability discovered in Moodle versions before 3.10.1, 3.9.4, 3.8.7, and 3.5.16. The vulnerability allowed site administrators to execute arbitrary PHP scripts through a PHP include functionality used during Shibboleth authentication (Moodle Advisory).

The vulnerability is classified with a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The issue is related to improper control of code generation (CWE-94) and inclusion of functionality from untrusted control sphere (CWE-829) (NVD).

If exploited, this vulnerability could allow authenticated site administrators to execute arbitrary PHP code on the server through the Shibboleth authentication mechanism, potentially leading to complete system compromise (Moodle Advisory).

The vulnerability requires high privileges (site administrator access) to exploit, but has low attack complexity and requires no user interaction. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in Moodle versions 3.10.1, 3.9.4, 3.8.7, and 3.5.16. As a workaround, administrators can hardcode preventexecpath to true in config.php, which prevents site administrators from setting some executable paths via the UI (Moodle Advisory).