Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-30599: Moodle Badges Configuration SQL Injection Risk
CVE-2022-30599 · published 4 years ago
Summary
Moodle users who manage badges may be at risk of unauthorized database access. This issue affects the configuration of badge criteria and could allow an attacker to manipulate the database. To protect your system, update to the latest Moodle version or apply the recommended patch.
What to do
- Update moodle moodle to version 4.0.1.
- Update moodle moodle to version 3.11.7.
- Update moodle moodle to version 3.10.11.
- Update moodle moodle to version 3.9.14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | moodle | moodle |
>= 4.0, < 4.0.1 >= 3.11, < 3.11.7 >= 3.10, < 3.10.11 >= 3.9, < 3.9.14 Fix: upgrade to 4.0.1
|
| – | moodle | moodle |
4.0.0 cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* |
| – | fedoraproject | fedora |
34 35 36 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | moodle | All versions |
Original advisory text
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74333 URL
- https://github.com/moodle/moodle/commit/a0f47c8bc4d6f5971025de7d63f22475701d2f86
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://github.com/advisories/GHSA-69c3-5xxf-58q2
- https://ubuntu.com/security/CVE-2022-30599 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-30599 Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=434581 URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2083610 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30599... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-30599 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-89SQL Injection
Timeline
Published18 May 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-69c3-5xxf-58q2 · GHSA
CVE-2022-30599 · NVD
UBUNTU-CVE-2022-30599 · OSV
CVE-2022-30599 · OSV
Track software like this
Free during beta