Log in Start free

Vulnerability · Published May 18, 2022 · Assigned by fedora

CVE-2022-30599

Critical 9.8

In plain English

A critical-severity SQL injection in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle4.0.1GHSA-69c3-5xxf-58q2
Packagistmoodle/moodle3.11.7GHSA-69c3-5xxf-58q2
Packagistmoodle/moodle3.10.11GHSA-69c3-5xxf-58q2
Packagistmoodle/moodle3.9.14GHSA-69c3-5xxf-58q2

Affected products (as reported)

VendorProductVersions
n/a moodle Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions

Weakness: CWE-89

References