Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2023-35132

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

VectorNETWORK

PublishedJun 22, 2023, 21:15

Published Bypatrick@puiterwijk.org

Base Score

Score6.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)4.2.04.2.1N/A

moodle/moodle(Packagist)4.1.04.1.4N/A

moodle/moodle(Packagist)4.0.04.0.9N/A

moodle/moodle(Packagist)3.10.03.11.15N/A

moodle/moodle(Packagist)03.9.22N/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=2214371
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
https://moodle.org/mod/forum/discuss.php?d=447830

Weakness Type

CWE-89

CVSS Metrics

Base Score

6.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK