PT-2022-2039 · Moodle+2 · Moodle+2

Tej Rathi · Published 2022-03-14 · Updated 2024-03-06 · CVE-2022-0984

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue is related to insufficient access control in the virtual learning environment. It allows users with the capability to configure badge criteria, such as teachers and managers by default, to configure course badges with profile field criteria. This capability should only be available for site badges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

ALT-PU-2022-1476

ALT-PU-2022-2450

BDU:2022-01638

BIT-MOODLE-2022-0984

CVE-2022-0984

GHSA-C5HF-MC85-2HX4

Affected Products

Alt Linux

Moodle

Red Os

References · 19

• https://osv.dev/vulnerability/GHSA-c5hf-mc85-2hx4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0984 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0984 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YUKZRCAZHHWVDKP6P3UUVJ7I3DZZ6WRT · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-0984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0984 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AMOXP6M3ZE5SJKSIBY7S3REJYAHGZLER · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-0984 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0984 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01638 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/cdc78a16a5da95a17fb10bf1c66689237f5a3f7d · Note
• https://moodle.org/mod/forum/discuss.php?d=432949 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2064118 · Note