PT-2022-2038 · Moodle+2 · Moodle+2

Tej Rathi · Published 2022-03-14 · Updated 2024-03-06 · CVE-2022-0985

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue is related to insufficient capability checks in Moodle, which could allow users with the moodle/site:uploadusers capability to delete users without having the necessary moodle/user:delete capability. This could potentially be exploited by a remote attacker to delete arbitrary users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-264

CWE-287

Related Identifiers

ALT-PU-2022-1476

ALT-PU-2022-1641

ALT-PU-2022-2450

BDU:2022-01637

BIT-MOODLE-2022-0985

CVE-2022-0985

GHSA-6Q9G-3VFQ-Q2QJ

Affected Products

Alt Linux

Moodle

Red Os

References · 19

• https://osv.dev/vulnerability/BIT-moodle-2022-0985 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01637 · Security Note
• https://ubuntu.com/security/CVE-2022-0985 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0985 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0985 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YUKZRCAZHHWVDKP6P3UUVJ7I3DZZ6WRT · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0985 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2064117 · Patch
• https://osv.dev/vulnerability/GHSA-6q9g-3vfq-q2qj · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AMOXP6M3ZE5SJKSIBY7S3REJYAHGZLER · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0985 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/addd4f894d8173ec8ff0ae2212d51a1977e7bcad · Note
• https://moodle.org/mod/forum/discuss.php?d=432948 · Note