Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

VectorNETWORK

PublishedMar 23, 2023, 21:15

Published Bypatrick@puiterwijk.org

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)4.1.04.1.2N/A

moodle/moodle(Packagist)4.0.04.0.7N/A

moodle/moodle(Packagist)3.11.03.11.13N/A

moodle/moodle(Packagist)03.9.20N/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=2179406
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
https://moodle.org/mod/forum/discuss.php?d=445061

Weakness Type

CWE-89

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK