CVE-2022-0334

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863 CWE-668

Affected software

Vendor	Product	Versions
n/a	moodle	moodle 3.11.5, moodle 3.10.9 and moodle 3.9.12

References

https://bugzilla.redhat.com/show_bug.cgi?id=2043664Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=431102Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2043664Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=431102Patch, Vendor Advisory

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03358.8A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge ali CVE-2022-03368.8The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread CVE-2022-03376.5Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potent CVE-2022-03384.3Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.CVE-2022-03399.8Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-03415.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.CVE-2022-03429.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi CVE-2022-03437.8A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) ma CVE-2022-03444.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.CVE-2022-03454.3The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users CVE-2022-03466.1The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu CVE-2022-03476.1The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i