GitHub Advisory DatabaseGHSA-72W2-J52C-7682Moodle SQL Injection vulnerability
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
54.3%
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| moodle/moodle | lt | 3.9.20 | |
| moodle/moodle | lt | 3.11.13 | |
| moodle/moodle | lt | 4.0.7 | |
| moodle/moodle | lt | 4.1.2 |
References
bugzilla.redhat.com/show_bug.cgi?id=2179406
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77046
github.com/advisories/GHSA-72w2-j52c-7682
github.com/moodle/moodle/commit/81e74af17f419f7910f81279efecf5c7af09f38d
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
lists.fedoraproject.org/archives/list/[email protected]/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
moodle.org/mod/forum/discuss.php?d=445061
nvd.nist.gov/vuln/detail/CVE-2023-28329
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
54.3%