GitHub Advisoryadvisory · Packagist

GHSA-xpfv-89vg-r562 Cross Site Request Forgery in Moodle

HIGH Published 2022-01-28 Modified 2022-02-02 Official page ↗
Aliases
CVE-2022-0335
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-01-26

Affected packages

• Packagist moodle/moodle: >= 3.11, < 3.11.5 → fixed in 3.11.5 • Packagist moodle/moodle: >= 3.10, < 3.10.8 → fixed in 3.10.8 • Packagist moodle/moodle: >= 3.9, < 3.9.11 → fixed in 3.9.11

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Related

Alias · CVE (1)

  • CVE-2022-0335 A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References