| Vulnerability Name: | CVE-2022-0984 (CCN-225585) |
| Assigned: | 2022-04-28 |
| Published: | 2022-04-28 |
| Updated: | 2022-05-10 |
| Summary: | Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
|
| CVSS v3 Severity: | 4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance | | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-863
|
| Vulnerability Consequences: | Bypass Security |
| References: | Source: MITRE
Type: CNA
CVE-2022-0984
Source: CCN
Type: Red Hat Bugzilla - Bug 2064118
(CVE-2022-0984, MSA-22-0007) - CVE-2022-0984 moodle: possible to reach the profile field badge criteria on a course page
Source: MISC
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2064118
Source: XF
Type: UNKNOWN
moodle-cve20220984-sec-bypass(225585)
Source: CCN
Type: moodle.git Repository
weekly release 4.1dev
Source: CCN
Type: Mend Vulnerability Database
CVE-2022-0984
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:moodle:moodle:*:*:*:*:*:*:*:* (Version >= 3.9.0 and < 3.9.13)OR cpe:/a:moodle:moodle:*:*:*:*:*:*:*:* (Version >= 3.10.0 and < 3.10.10)OR cpe:/a:moodle:moodle:*:*:*:*:*:*:*:* (Version >= 3.11.0 and < 3.11.6)
Configuration 2:
cpe:/o:fedoraproject:fedora:34:*:*:*:*:*:*:*OR cpe:/o:fedoraproject:fedora:35:*:*:*:*:*:*:*OR cpe:/o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Configuration 3:
cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:moodle:moodle:3.11.5:*:*:*:*:*:*:*OR cpe:/a:moodle:moodle:3.9.12:*:*:*:*:*:*:*OR cpe:/a:moodle:moodle:3.10.9:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |