GHSA-h2fw-93qx-vrcq

SQL Injection in Moodle

Source: GitHub Advisory Database (reviewed) High CVE-2022-0983

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	moodle/moodle	>= 3.11.0, < 3.11.6	3.11.6
Packagist	moodle/moodle	>= 3.10.0, < 3.10.10	3.10.10
Packagist	moodle/moodle	< 3.9.13	3.9.13

Details

As written in the advisory (Markdown source, shown as plain text).

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-0983 advisory
https://github.com/moodle/moodle/commit/c2794752ea3cdda2d64a0651da08b2cdf730d9f1 web
https://bugzilla.redhat.com/show_bug.cgi?id=2064119 web
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74074 web
https://github.com/moodle/moodle package
https://lists.fedoraproject.org/archives/list/[email protected]/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y web