CVE-2022-0334
25.01.2022, 20:15
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.Enginsight
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 ≤ 3.8.9 |
| moodle | moodle | 3.9.0 ≤ 𝑥 ≤ 3.9.11 |
| moodle | moodle | 3.10.0 ≤ 𝑥 < 3.10.9 |
| moodle | moodle | 3.11.0 ≤ 𝑥 < 3.11.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
- CWE-668 - Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.