PT-2022-2689 · Moodle+2 · Moodle+2

Michael Dunstan · Published 2022-03-31 · Updated 2024-03-06 · CVE-2022-30599

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A flaw was found in Moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. The vulnerability is related to insufficient sanitization of user input in the badges code, allowing a remote attacker to execute arbitrary SQL code by sending a specially crafted request. This can enable the attacker to execute arbitrary commands in the application's database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2022-2502

ALT-PU-2022-2553

BDU:2022-03179

BIT-MOODLE-2022-30599

CVE-2022-30599

GHSA-69C3-5XXF-58Q2

Affected Products

Alt Linux

Moodle

Red Os

References · 30

• https://nvd.nist.gov/vuln/detail/CVE-2022-30599 · Security Note
• https://bdu.fstec.ru/vul/2022-03179 · Security Note
• https://osv.dev/vulnerability/GHSA-69c3-5xxf-58q2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30599 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30599 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=434581 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5 · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6 · Vendor Advisory
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-30599 · Vendor Advisory