CVE-2023-35132: Moodle: minor sql injection risk on mnet sso access control page
First published: Mon Jun 12 2023(Updated: )
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle Moodle | <3.9.22 | |
| Moodle Moodle | >=3.11.0<3.11.15 | |
| Moodle Moodle | >=4.0.0<4.0.9 | |
| Moodle Moodle | >=4.1.0<4.1.4 | |
| Moodle Moodle | =4.2.0 | |
| composer/moodle/moodle | <3.9.22 | 3.9.22 |
| composer/moodle/moodle | >=3.10.0<3.11.15 | 3.11.15 |
| composer/moodle/moodle | >=4.0.0<4.0.9 | 4.0.9 |
| composer/moodle/moodle | >=4.1.0<4.1.4 | 4.1.4 |
| composer/moodle/moodle | =4.2.0 | 4.2.1 |
| redhat/moodle | <4.2.1 | 4.2.1 |
| redhat/moodle | <4.1.4 | 4.1.4 |
| redhat/moodle | <4.0.9 | 4.0.9 |
| redhat/moodle | <3.11.15 | 3.11.15 |
| redhat/moodle | <3.9.22 | 3.9.22 |
| <3.9.22 | ||
| >=3.11.0<3.11.15 | ||
| >=4.0.0<4.0.9 | ||
| >=4.1.0<4.1.4 | ||
| =4.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
- https://moodle.org/mod/forum/discuss.php?d=447830
- https://nvd.nist.gov/vuln/detail/CVE-2023-35132
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-77193
- https://github.com/advisories/GHSA-49mv-vfcp-8gg9 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2214371
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216002
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2216001
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT
Frequently Asked Questions
What is CVE-2023-35132?
CVE-2023-35132 is a vulnerability that allows for limited SQL injection on the Mnet SSO access control page in Moodle.
Which versions of Moodle are affected by CVE-2023-35132?
Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21, and earlier unsupported versions are affected by CVE-2023-35132.
What is the severity of CVE-2023-35132?
CVE-2023-35132 has a severity rating of 6.3, which is considered medium.
How does CVE-2023-35132 work?
CVE-2023-35132 allows an attacker to execute limited SQL injection attacks on the Mnet SSO access control page in Moodle.
Is there a fix for CVE-2023-35132?
Yes, patches have been released to fix CVE-2023-35132. It is recommended to update to the latest version of Moodle.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-35132
- agent/software-canonical-lookup
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-49mv-vfcp-8gg9
- agent/last-modified-date
- agent/references
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/3.11.0
- version/moodle moodle/4.0.0
- version/moodle moodle/4.1.0
- version/moodle moodle/4.2.0
- package-manager/redhat
- package-manager/composer