GitHub Advisoryadvisory · Packagist

GHSA-xhq3-455r-xv44 Moodle SQL injection via user preferences

CRITICAL Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-2641
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 2.7, < 2.7.19 → fixed in 2.7.19 • Packagist moodle/moodle: >= 3.0, < 3.0.9 → fixed in 3.0.9 • Packagist moodle/moodle: >= 3.1, < 3.1.5 → fixed in 3.1.5 • Packagist moodle/moodle: >= 3.2, < 3.2.2 → fixed in 3.2.2

Description

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

Related

Alias · CVE (1)

  • CVE-2017-2641 In Moodle 2.x and 3.x, SQL injection can occur via user preferences. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References