GHSA-c5hf-mc85-2hx4
Missing authorization in Moodle
At a glance
- Published
- Updated
- CVE
- CVE-2022-0984
- Aliases
- BIT-moodle-2022-0984
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.11.0, fixed 3.11.6 |
| Packagist · moodle/moodle | introduced 3.10.0, fixed 3.10.10 |
| Packagist · moodle/moodle | introduced 0, fixed 3.9.13 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-0984 ADVISORY
- https://github.com/moodle/moodle/commit/cdc78a16a5da95a17fb10bf1c66689237f5a3f7d WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2064118 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2064125 WEB
- https://github.com/moodle/moodle PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |