PT-2022-13111 · Moodle+1 · Moodle+1

Oct0Pus7 · Published 2022-01-17 · Updated 2024-03-06 · CVE-2022-0333

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.11 to 3.11.4 Moodle versions 3.10 to 3.10.8 Moodle versions 3.9 to 3.9.11 Moodle versions earlier than 3.9

Description A flaw was found in the calendar:manageentries capability, which allowed managers to access or modify any calendar event. However, this capability should have been restricted from accessing user-level events.

Recommendations For versions 3.11 to 3.11.4, restrict the calendar:manageentries capability to prevent managers from accessing user-level events. For versions 3.10 to 3.10.8, restrict the calendar:manageentries capability to prevent managers from accessing user-level events. For versions 3.9 to 3.9.11, restrict the calendar:manageentries capability to prevent managers from accessing user-level events. For versions earlier than 3.9, restrict the calendar:manageentries capability to prevent managers from accessing user-level events.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2022-1064

ALT-PU-2022-1641

ALT-PU-2022-2450

BIT-MOODLE-2022-0333

CVE-2022-0333

GHSA-M434-M5PV-P35W

Affected Products

Alt Linux

Moodle

References · 12

• https://ubuntu.com/security/CVE-2022-0333 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0333 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0333 · Security Note
• https://osv.dev/vulnerability/GHSA-m434-m5pv-p35w · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=431100 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-0333 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0333 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/2ee27313cea0d7073f5a6a35eccdfddcb3a9adad · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2043663 · Note
• https://t.me/cibsecurity/36251 · Telegram Post