PT-2022-2037 · Fedoraproject+2 · Extra Packages For Enterprise Linux+3

Tej Rathi · Published 2022-03-14 · Updated 2024-03-06 · CVE-2022-0983

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified) fedoraproject extra packages for enterprise linux (affected versions not specified) fedoraproject fedora (affected versions not specified)

Description The issue is related to a lack of protection against SQL query structure exploitation, allowing a remote attacker to execute arbitrary SQL queries in the database. An SQL injection risk was identified in Badges code, specifically in configuring criteria, with access limited to teachers and managers by default.

Recommendations For Moodle, consider restricting access to the Badges code configuring criteria capability to minimize the risk of exploitation. For fedoraproject extra packages for enterprise linux and fedoraproject fedora, at the moment, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider disabling the SQL query execution functionality in the affected components until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2022-1476

ALT-PU-2022-2450

BDU:2022-01636

BIT-MOODLE-2022-0983

CVE-2022-0983

GHSA-H2FW-93QX-VRCQ

Affected Products

Alt Linux

Red Os

Extra Packages For Enterprise Linux

Fedora

References · 19

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-0983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0983 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2fw-93qx-vrcq · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0983 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0983 · Security Note
• https://bdu.fstec.ru/vul/2022-01636 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0983 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/c2794752ea3cdda2d64a0651da08b2cdf730d9f1 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74074 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-cve-2022-0983-cve-2022-0984-cve-2022-0985 · Note