CVE-2023-28329: Moodle SQL Injection vulnerability
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.20
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-28329.
What is the severity of CVE-2023-28329?
The severity of CVE-2023-28329 is high (8.8).
What software versions are affected by CVE-2023-28329?
Software versions between 3.9.0 and 3.9.20, 3.11.0 and 3.11.13, and 4.0.0 and 4.0.7 of Moodle are affected by CVE-2023-28329.
What is the CWE ID of CVE-2023-28329?
The CWE ID of CVE-2023-28329 is CWE-89.
How can I fix CVE-2023-28329?
To fix CVE-2023-28329, update your Moodle software to a version that is not affected by the vulnerability.