medium4.3
CVE-2022-0984
Missing authorization in Moodle
Impact
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.11.0, < 3.11.6 | 3.11.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 3.9.0 before 3.9.13 from 3.10.0 before 3.10.10 from 3.11.0 before 3.11.6 |
| Fedoraproject | Fedora | Versions 34, 35, 36 |
| Redhat | Enterprise Linux | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2064118
- https://github.com/advisories/GHSA-c5hf-mc85-2hx4
- https://nvd.nist.gov/vuln/detail/CVE-2022-0984
- https://github.com/moodle/moodle/commit/cdc78a16a5da95a17fb10bf1c66689237f5a3f7d
- https://bugzilla.redhat.com/show_bug.cgi?id=2064125