CVE-2022-0334: Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Other sources
Insufficient user authorization in Moodle
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.5 - Upgrade
Upgrade
redhat/moodle 3.10.9 and moodleto a version that resolves this vulnerability.Fixed in 3.9.12 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.10.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.5
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0334?
CVE-2022-0334 is classified as a medium severity vulnerability due to insufficient capability checks.
How do I fix CVE-2022-0334?
To fix CVE-2022-0334, upgrade Moodle to version 3.11.5 or 3.9.12, or ensure you are running a version beyond the specified vulnerable versions.
What versions of Moodle are affected by CVE-2022-0334?
CVE-2022-0334 affects Moodle versions 3.11.0 to 3.11.4, 3.10.0 to 3.10.8, and 3.9.0 to 3.9.11.
Can CVE-2022-0334 lead to data exposure?
Yes, CVE-2022-0334 can potentially lead to unauthorized users accessing grade reports they are not permitted to view.
Is there a workaround for CVE-2022-0334?
Currently, there is no specific workaround for CVE-2022-0334; the recommended action is to update to a fixed version.