CVE-2022-0984: Medium severity moodle vulnerability

Q: What is the severity of CVE-2022-0984?

CVE-2022-0984 has been rated as a medium severity vulnerability.

Q: How do I fix CVE-2022-0984?

To fix CVE-2022-0984, update Moodle to versions 3.11.6, 3.10.10, or 3.9.13 or later.

Q: What versions are affected by CVE-2022-0984?

CVE-2022-0984 affects Moodle versions 3.11 to 3.11.5, 3.10 to 3.10.9, and 3.9 to 3.9.12.

Q: Who is impacted by CVE-2022-0984?

Users with the capability to configure badge criteria, typically teachers and managers, are impacted by CVE-2022-0984.

Q: Is there a workaround for CVE-2022-0984?

There are no specific workarounds for CVE-2022-0984; updating to a patched version is recommended.

Published Mar 15, 2022

Updated

Description: Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

Versions affected: 3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versions

References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74075

Affected Software

10 affected componentsFixes available

redhat/moodle<3.11.6

3.11.6

redhat/moodle<3.10.10

3.10.10

redhat/moodle<3.9.13

3.9.13

Moodle Moodle>=3.9.0<3.9.13

Moodle Moodle>=3.10.0<3.10.10

Moodle Moodle>=3.11.0<3.11.6

Fedoraproject Fedora=34

Fedoraproject Fedora=35

Fedoraproject Fedora=36

redhat Enterprise Linux=7.0

Event History

Mar 15, 2022

Data Sourced

via Red Hat·06:13 AM

DescriptionSeverityAffected Software

Apr 29, 2022

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2022-0984?

CVE-2022-0984 has been rated as a medium severity vulnerability.

How do I fix CVE-2022-0984?

To fix CVE-2022-0984, update Moodle to versions 3.11.6, 3.10.10, or 3.9.13 or later.

What versions are affected by CVE-2022-0984?