GHSA-xpfv-89vg-r562

Cross Site Request Forgery in Moodle

En bref

Publiée: 2022-01-28 22:07 UTC
Mise à jour: 2024-02-16 07:47 UTC
CVE: CVE-2022-0335
Alias: BIT-moodle-2022-0335
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Paquets affectés

Paquet	Versions
Packagist · moodle/moodle	introduced 3.11, fixed 3.11.5
Packagist · moodle/moodle	introduced 3.10, fixed 3.10.8
Packagist · moodle/moodle	introduced 3.9, fixed 3.9.11

Références

https://nvd.nist.gov/vuln/detail/CVE-2022-0335 ADVISORY
https://github.com/moodle/moodle/commit/d40cc61eba229c6d1f47b9a525022fbc9136b9f6 WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2043666 WEB
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=431103 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database