Vulnerability · Published Jan 25, 2022 · Assigned by fedora
CVE-2022-0335
High 8.8
In plain English
A high-severity cross-site request forgery in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | moodle/moodle | 3.11.5 | GHSA-xpfv-89vg-r562 |
| Packagist | moodle/moodle | 3.10.8 | GHSA-xpfv-89vg-r562 |
| Packagist | moodle/moodle | 3.9.11 | GHSA-xpfv-89vg-r562 |
Affected products (as reported)
Weakness: CWE-352
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2043666 x_refsource_MISC
- https://moodle.org/mod/forum/discuss.php?d=431103 x_refsource_MISC