CVE-2022-30597: External Control of Assumed-Immutable Web Parameter in moodle
Summary
CVE-2022-30597: External Control of Assumed-Immutable Web Parameter in moodle. Affects moodle/moodle across 4 version ranges.
>= 3.9, < 3.9.14
>= 3.10, < 3.10.11
>= 3.11, < 3.11.7
>= 4.0, < 4.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2022-30597 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and deliver online courses. It provides a platform for educators to manage and organize course materials, interact with students, and assess their progress. Moodle is written in PHP and utilizes a database to store user information, course content, and other relevant data. This vulnerability affects versions 3.9 to 4.0.1 of the Moodle package.
Vulnerability Detail
The vulnerability identified as CVE-2022-30597 in Moodle allows an attacker to externally control an assumed-immutable web parameter. Specifically, the description user field in Moodle was not properly hidden when set as a hidden user field. This flaw could potentially lead to unauthorized access or manipulation of user data. The impact of this vulnerability is considered moderate, with a CVSS score of 5.3. It is important to note that this vulnerability has been fixed in Moodle versions 3.9.14, 3.10.11, 3.11.7, and 4.0.1.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.9, < 3.9.143.9.14composer require moodle/moodle:3.9.14 -
>= 3.10, < 3.10.113.10.11composer require moodle/moodle:3.10.11 -
>= 3.11, < 3.11.73.11.7composer require moodle/moodle:3.11.7 -
>= 4.0, < 4.0.14.0.1composer require moodle/moodle:4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in Moodle, identified as CVE-2022-30597, allows external control of an assumed-immutable web parameter. It is important to update the Moodle package to the latest fixed version (3.9.14, 3.10.11, 3.11.7, or 4.0.1) to mitigate the risk of unauthorized access or data manipulation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions for online course management.
The vulnerability allows external control of an assumed-immutable web parameter, potentially leading to unauthorized access or manipulation of user data.
Versions 3.9 to 4.0.1 of the Moodle package are affected by this vulnerability.
To fix this vulnerability, update the Moodle package to the latest fixed version (3.9.14, 3.10.11, 3.11.7, or 4.0.1).
No workaround is available for this vulnerability. Updating to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
