Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2023-28329: Moodle lets logged‑in teachers execute database commands
CVE-2023-28329 · published 3 years ago
Summary
When a teacher or manager checks whether a profile field is available, Moodle does not properly verify the input. This can let an attacker run unauthorized database queries, potentially exposing or altering data. Apply the latest Moodle update or patch that corrects the input validation.
What to do
- Update moodle moodle to version 4.1.2.
- Update moodle moodle to version 4.0.7.
- Update moodle moodle to version 3.11.13.
- Update moodle moodle to version 3.9.20.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | moodle | moodle |
>= 4.1.0, < 4.1.2 >= 4.0.0, < 4.0.7 >= 3.11.0, < 3.11.13 < 3.9.20 Fix: upgrade to 4.1.2
|
| – | moodle | moodle |
> 3.9.0, < 3.9.20 3.9.0 3.11.0 4.0.0 4.1.0 4.1.1 cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | moodle | All versions |
Original advisory text
Moodle: authenticated sql injection via availability check
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-28329 Vendor Advisory
- https://github.com/moodle/moodle/commit/81e74af17f419f7910f81279efecf5c7af09f38d
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77046
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://github.com/advisories/GHSA-72w2-j52c-7682
- https://ubuntu.com/security/CVE-2023-28329 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-28329 Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=445061 URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2179406 Third Party Advisory
- https://git.moodle.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28329... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.3
Medium
Type
CWE-89SQL Injection
Timeline
Published23 Mar 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-72w2-j52c-7682 · GHSA
CVE-2023-28329 · NVD
UBUNTU-CVE-2023-28329 · OSV
CVE-2023-28329 · OSV
Track software like this
Free during beta