ALT-PU-2022-1064-2
Closed vulnerabilities
BDU:2023-03479
Уязвимость компонента mod_h5pactivity виртуальной обучающей среды Moodle, позволяющая нарушителю выполнять произвольные SQL-запросы в базе данных
Modified: 2024-11-21
CVE-2022-0332
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Modified: 2024-11-21
CVE-2022-0333
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Modified: 2024-11-21
CVE-2022-0334
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Modified: 2024-11-21
CVE-2022-0335
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Modified: 2022-02-02
GHSA-6jhm-4vmx-mr76
SQL injection in Moodle
Modified: 2022-02-02
GHSA-93pj-4p65-qmr9
Insufficient user authorization in Moodle
- https://nvd.nist.gov/vuln/detail/CVE-2022-0334
- https://github.com/moodle/moodle/commit/1964d68f8500ea3c7b776fa8a2af6266ed109f84
- https://github.com/moodle/moodle/commit/6d18f136ae88ec97e351a723df570816a959ec68
- https://bugzilla.redhat.com/show_bug.cgi?id=2043664
- https://moodle.org/mod/forum/discuss.php?d=431102
Modified: 2022-02-02
GHSA-m434-m5pv-p35w
Insufficient user authorization in Moodle
Modified: 2022-02-02
GHSA-xpfv-89vg-r562
Cross Site Request Forgery in Moodle
