GitHub Advisoryadvisory · Packagist

GHSA-6jhm-4vmx-mr76 SQL injection in Moodle

CRITICAL Published 2022-01-28 Modified 2022-02-02 Official page ↗
Aliases
CVE-2022-0332
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2022-01-26

Affected packages

• Packagist moodle/moodle: >= 3.11, < 3.11.5 → fixed in 3.11.5

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

Related

Alias · CVE (1)

  • CVE-2022-0332 A flaw was found in Moodle in versions 3.11 to 3.11.4. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References