GHSA-49mv-vfcp-8gg9
Moodle vulnerable to SQL Injection
At a glance
- Published
- Updated
- CVE
- CVE-2023-35132
- Aliases
- BIT-moodle-2023-35132
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.2.0, fixed 4.2.1 |
| Packagist · moodle/moodle | introduced 4.1.0, fixed 4.1.4 |
| Packagist · moodle/moodle | introduced 4.0.0, fixed 4.0.9 |
| Packagist · moodle/moodle | introduced 3.10.0, fixed 3.11.15 |
| Packagist · moodle/moodle | introduced 0, fixed 3.9.22 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-35132 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2214371 WEB
- https://github.com/moodle/moodle PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT WEB
- https://moodle.org/mod/forum/discuss.php?d=447830 WEB
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77193 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |