CVE-2023-28329
Moodle: authenticated sql injection via availability check
Summary
Moodle: authenticated sql injection via availability check
Original description
The description as published by the source.
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"3.9.0"},{"fixed":"3.9.20"},{"introduced":"3.11.0"},{"fixed":"3.11.13"},{"introduced":"4.0.0"},{"fixed":"4.0.7"},{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]
References
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory github.com
- report bugzilla.redhat.com
- web moodle.org
- web git.moodle.org