VULNERABILITY INTELLIGENCE

CVE-2022-0334

CVSS score4.3 MEDIUM

EPSS probability0.71%

CISA KEVNot currently listed

Published2022-01-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

Weakness classification

CWE-668: Exposure of Resource to Wrong Sphere
CWE-863: Incorrect Authorization

Primary references

patrick@puiterwijk.org — Issue Tracking, Third Party Advisory
patrick@puiterwijk.org — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory