PT-2022-2692 · Moodle+2 · Moodle+2

Shamim Rezaie · Published 2020-11-08 · Updated 2024-03-06 · CVE-2022-30600

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A flaw was found in the logic used to count failed login attempts, which could result in the account lockout threshold being bypassed. This issue is related to the implementation of the core auth class in the Moodle virtual learning environment, specifically with the limitations of excessive authentication attempts. Exploitation of this issue may allow a remote attacker to bypass security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-682

Related Identifiers

ALT-PU-2020-3235

ALT-PU-2022-2502

ALT-PU-2022-2553

BDU:2022-03182

BIT-MOODLE-2022-30600

CVE-2022-30600

GHSA-W37F-PVVX-WCWM

Affected Products

Alt Linux

Moodle

Red Os

References · 32

• 🔥 https://github.com/Boonjune/POC-CVE-2022-30600 · Exploit
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-73736 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30600 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-30600 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=434582 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2022-30600 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5 · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-30600 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03182 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w37f-pvvx-wcwm · Vendor Advisory