Log in Start free

Vulnerability · Published May 18, 2022 · Assigned by fedora

CVE-2022-30600

Critical 9.8

In plain English

A critical-severity security flaw in moodle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)5.1%top 7.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistmoodle/moodle4.0.1GHSA-w37f-pvvx-wcwm
Packagistmoodle/moodle3.9.14GHSA-w37f-pvvx-wcwm
Packagistmoodle/moodle3.10.11GHSA-w37f-pvvx-wcwm
Packagistmoodle/moodle3.11.7GHSA-w37f-pvvx-wcwm

Affected products (as reported)

VendorProductVersions
n/a moodle Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions

Weakness: CWE-682

References