CVE-2022-30597 : A flaw was found in moodle where the description user field was not hidden when

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.

Published 2022-05-18 18:15:10

Updated 2022-12-21 15:01:20

Source Fedora Project

View at NVD, CVE.org

Products affected by CVE-2022-30597

Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
Matching versions
Moodle » Moodle
Versions from including (>=) 3.10 and before (<) 3.10.11
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle
Versions from including (>=) 3.11 and before (<) 3.11.7
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle
Versions from including (>=) 3.9 and before (<) 3.9.14
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle » Version: 4.0.0
cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 36
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-472 External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Assigned by: patrick@puiterwijk.org (Secondary)

https://bugzilla.redhat.com/show_bug.cgi?id=2083585

2083585 – (CVE-2022-30597, MSA-22-0011) CVE-2022-30597 moodle: Description field hidden by user policies (hiddenuserfields) is still visible
Issue Tracking;Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=434579

Moodle.org: MSA-22-0011: Description field hidden by user policies (hiddenuserfields) is still visible
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIMSIRKCFLIC646K4GMUSZU7THOUVPAJ/

[SECURITY] Fedora 36 Update: moodle-3.11.7-1.fc36 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74318

Official Moodle git projects - moodle.git/search
Patch;Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCTWSE3JDMSYL7DPCMXMMJEXZSS6VIA5/

[SECURITY] Fedora 35 Update: moodle-3.11.7-1.fc35 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGF35EN5K2R6X3NTY3XPZSJ3UDASMXI6/

[SECURITY] Fedora 34 Update: moodle-3.11.7-1.fc34 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to