CVE-2022-0335: CSRF
Published Jan 21, 2022
·Updated
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Affected Software
9 affected componentsFixes available
composer/moodle/moodle>=3.9<3.9.11
3.9.11
composer/moodle/moodle>=3.10<3.10.8
3.10.8
composer/moodle/moodle>=3.11<3.11.5
3.11.5
redhat/moodle<3.11.5
3.11.5
redhat/moodle 3.10.9 and moodle<3.9.12
3.9.12
Moodle moodle<=3.8.9
Moodle moodle>=3.9.0<3.9.12
Moodle moodle>=3.10.0<3.10.9
Moodle moodle>=3.11.0<3.11.5
Event History
Jan 25, 2022
CVE Published
via MITRE·07:11 PM
Data Sourced
via MITRE·07:11 PM
DescriptionWeakness
Jan 28, 2022
Advisory Published
10:07 PM
Frequently Asked Questions
1
What is the severity of CVE-2022-0335?
CVE-2022-0335 is classified as a moderate severity vulnerability due to its impact on security through CSRF risk.
2
How do I fix CVE-2022-0335?
To fix CVE-2022-0335, upgrade Moodle to version 3.11.5 or later, 3.10.9 or later, or 3.9.12 or later.
3
What versions of Moodle are affected by CVE-2022-0335?
CVE-2022-0335 affects Moodle versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11, and earlier unsupported versions.
4
What type of vulnerability is CVE-2022-0335?
CVE-2022-0335 is a Cross-Site Request Forgery (CSRF) vulnerability that arises from missing token checks.
5
What functionality is impacted by CVE-2022-0335?
CVE-2022-0335 impacts the "delete badge alignment" functionality within Moodle.