GHSA-93pj-4p65-qmr9
Insufficient user authorization in Moodle
At a glance
- Published
- Updated
- CVE
- CVE-2022-0334
- Aliases
- BIT-moodle-2022-0334
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.11, fixed 3.11.5 |
| Packagist · moodle/moodle | introduced 3.10, fixed 3.10.8 |
| Packagist · moodle/moodle | introduced 0, fixed 3.9.11 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0334 ADVISORY
- https://github.com/moodle/moodle/commit/1964d68f8500ea3c7b776fa8a2af6266ed109f84 WEB
- https://github.com/moodle/moodle/commit/6d18f136ae88ec97e351a723df570816a959ec68 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2043664 WEB
- https://moodle.org/mod/forum/discuss.php?d=431102 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |