CVE-2021-40691: 
PHP vulnerability analysis and mitigation

A session hijack vulnerability (CVE-2021-40691) was identified in the Shibboleth authentication plugin of Moodle. The vulnerability affects Moodle versions 3.9.x before 3.9.10, 3.10.x before 3.10.7, and 3.11.x before 3.11.3. This security issue was discovered and disclosed in September 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The vulnerability could allow attackers to perform session hijacking when the Shibboleth authentication plugin is enabled, potentially compromising user sessions and gaining unauthorized access to user accounts (Redhat Bugzilla).

The vulnerability requires network access and user interaction to be exploited. It specifically affects installations where the Shibboleth authentication plugin is enabled (NVD).

The vulnerability has been patched in Moodle versions 3.9.10, 3.10.7, and 3.11.3. Users are advised to upgrade to these or newer versions to mitigate the risk (NVD).