GHSA-xpfv-89vg-r562

Cross Site Request Forgery in Moodle

At a glance

Published: 2022-01-28 22:07 UTC
Updated: 2024-02-16 07:47 UTC
CVE: CVE-2022-0335
Aliases: BIT-moodle-2022-0335
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 3.11, fixed 3.11.5
Packagist · moodle/moodle	introduced 3.10, fixed 3.10.8
Packagist · moodle/moodle	introduced 3.9, fixed 3.9.11

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0335 ADVISORY
https://github.com/moodle/moodle/commit/d40cc61eba229c6d1f47b9a525022fbc9136b9f6 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2043666 WEB
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=431103 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database