CVE-2022-30600: Moodle - Bypass of Account Lockout Threshold
Summary
CVE-2022-30600: A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. Affects moodle across 4 version ranges.
>= 3.9.0, < 3.9.14
>= 3.10.0, < 3.10.11
>= 3.11.0, < 3.11.7
>= 4.0.0, < 4.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2022-30600 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system widely used for creating and managing online courses. It provides various features for educators and learners, including course management, content creation, and communication tools. Moodle is vulnerable to a flaw that allows the bypassing of the account lockout threshold.
Vulnerability Detail
The vulnerability in Moodle arises from a logic flaw in the counting of failed login attempts. Due to this flaw, an attacker can bypass the account lockout threshold, which is intended to prevent brute-force attacks. By exploiting this vulnerability, an attacker can repeatedly attempt to log in without triggering the lockout mechanism, potentially gaining unauthorized access to user accounts. This can lead to various security risks, such as data breaches, unauthorized access to sensitive information, and potential disruption of the learning environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9.0, < 3.9.143.9.14 -
>= 3.10.0, < 3.10.113.10.11 -
>= 3.11.0, < 3.11.73.11.7 -
>= 4.0.0, < 4.0.14.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by updating Moodle to the latest version.
Conclusion
The vulnerability in Moodle allows the bypassing of the account lockout threshold, potentially leading to unauthorized access and security risks. To mitigate this vulnerability, it is recommended to update Moodle to the latest version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The vulnerability allows attackers to bypass the account lockout threshold, potentially gaining unauthorized access to user accounts and causing security risks.
To fix this vulnerability, update Moodle to the latest version available, which includes the necessary fixes.
No, not all versions of Moodle are affected. The vulnerability exists in versions 3.9.0 to 3.9.14, 3.10.0 to 3.10.11, and 3.11.0 to 3.11.7. Moodle 4.0.0 is also affected.
No specific workaround is provided. It is crucial to update Moodle to the latest version to fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
