GitHub Advisoryadvisory · Packagist

GHSA-h2fw-93qx-vrcq SQL Injection in Moodle

HIGH Published 2022-03-26 Modified 2022-04-01 Official page ↗
Aliases
CVE-2022-0983
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2022-04-01

Affected packages

• Packagist moodle/moodle: >= 3.11.0, < 3.11.6 → fixed in 3.11.6 • Packagist moodle/moodle: >= 3.10.0, < 3.10.10 → fixed in 3.10.10 • Packagist moodle/moodle: < 3.9.13 → fixed in 3.9.13

Description

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.

Related

Alias · CVE (1)

  • CVE-2022-0983 An SQL injection risk was identified in Badges code relating to configuring criteria. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References