GitHub Advisoryadvisory · Packagist

GHSA-49mv-vfcp-8gg9 Moodle vulnerable to SQL Injection

MEDIUM Published 2023-06-22 Modified 2024-04-19 Official page ↗
Aliases
CVE-2023-35132
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-89
Reviewed
2023-06-23

Affected packages

• Packagist moodle/moodle: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Packagist moodle/moodle: >= 4.1.0, < 4.1.4 → fixed in 4.1.4 • Packagist moodle/moodle: >= 4.0.0, < 4.0.9 → fixed in 4.0.9 • Packagist moodle/moodle: >= 3.10.0, < 3.11.15 → fixed in 3.11.15 • Packagist moodle/moodle: < 3.9.22 → fixed in 3.9.22

Description

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Related

Alias · CVE (1)

  • CVE-2023-35132 A limited SQL injection risk was identified on the Mnet SSO access control page. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References