A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
CVE-2022-0334 - Medium Severity Vulnerability
Vulnerable Library - moodle/moodle-v2.6.2
Moodle - the world's open source learning platform
Dependency Hierarchy: - :x: **moodle/moodle-v2.6.2** (Vulnerable Library)
Found in HEAD commit: 27e1f740a162e55490d9ca929f243afbaa92476c
Found in base branch: master
Vulnerability Details
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Publish Date: 2022-01-25
URL: CVE-2022-0334
CVSS 3 Score Details (4.3)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://moodle.org/mod/forum/discuss.php?d=431102
Release Date: 2022-01-25
Fix Resolution: v3.9.12,v3.10.9,v3.11.5
Step up your Open Source Security Game with Mend here