Vulnerability · Published May 18, 2022 · Assigned by fedora

CVE-2022-30597

Medium 5.3

In plain English

A medium-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.3%top 28.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	moodle/moodle	4.0.1	GHSA-x6gm-qqwp-76gr
Packagist	moodle/moodle	3.11.7	GHSA-x6gm-qqwp-76gr
Packagist	moodle/moodle	3.10.11	GHSA-x6gm-qqwp-76gr
Packagist	moodle/moodle	3.9.14	GHSA-x6gm-qqwp-76gr

Affected products (as reported)

Vendor	Product	Versions
n/a	moodle	Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions

Weakness: CWE-472

References

https://moodle.org/mod/forum/discuss.php?d=434579 x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=2083585 x_refsource_MISC
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318 x_refsource_MISC
FEDORA-2022-89bfefbe48 vendor-advisory, x_refsource_FEDORA
FEDORA-2022-bd4457bcc4 vendor-advisory, x_refsource_FEDORA
FEDORA-2022-530fdc5202 vendor-advisory, x_refsource_FEDORA