REDHAT-BUG-2128151: Medium severity moodle vulnerability
Severity/Risk: Minor Versions affected: 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions Versions fixed: 4.0.4, 3.11.10 and 3.9.17 Reported by: Jari Vilkman and Bjørn Teistung Workaround: Access to this feature can be revoked by removing the mod/h5pactivity:reviewattempts capability from relevant users until the patch is applied. CVE identifier: CVE-2022-40316 Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71662 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72012 Tracker issue: MDL-71662 and MDL-72012 No groups filtering in H5P activity attempts report
Affected Software
Event History
Frequently Asked Questions
Which Moodle deployments are affected and which releases contain the fix?
Affected releases are 4.0 through 4.0.3, 3.11 through 3.11.9, 3.9 through 3.9.16, and earlier unsupported versions. The issue is fixed in Moodle 4.0.4, 3.11.10, and 3.9.17.
Who needs access for this issue to be relevant?
The issue concerns users who have the mod/h5pactivity:reviewattempts capability, which provides access to the H5P activity attempts report. The report does not apply group filtering.
What mitigation is available if updating cannot happen immediately?
Revoke the mod/h5pactivity:reviewattempts capability from relevant users until the patch can be applied. This removes access to the affected feature.