~ / search / GHSA-72w2-j52c-7682

GHSA-72w2-j52c-7682

Moodle SQL Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-28329

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.1.0, < 4.1.2 4.1.2
Packagist moodle/moodle >= 4.0.0, < 4.0.7 4.0.7
Packagist moodle/moodle >= 3.11.0, < 3.11.13 3.11.13
Packagist moodle/moodle < 3.9.20 3.9.20

Details

As written in the advisory (Markdown source, shown as plain text).

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

References

External links from the advisory. They lead to third-party sites.