CVE-2021-32476: 
PHP vulnerability analysis and mitigation

A denial-of-service vulnerability (CVE-2021-32476) was identified in the Moodle draft files area, affecting versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions. The vulnerability was discovered by Ben Samtleben and was fixed in versions 3.11, 3.10.4, 3.9.7, 3.8.9 and 3.5.18 (Moodle Forum).

The vulnerability stems from the Files API not respecting user file upload limits in the draft files area, which could lead to resource exhaustion. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The vulnerability could allow attackers to cause a denial-of-service condition by bypassing file upload limits in the draft files area, potentially leading to resource exhaustion and system unavailability (Moodle Forum).

The recommended mitigation is to upgrade to one of the fixed versions: 3.11, 3.10.4, 3.9.7, 3.8.9, or 3.5.18. These versions implement proper file upload limit checks in the draft files area (Moodle Forum).