CVE-2022-0335

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03368.8The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those alread CVE-2022-03376.5Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potent CVE-2022-03384.3Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.CVE-2022-03399.8Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.CVE-2022-03415.4Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.CVE-2022-03429.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi CVE-2022-03437.8A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) ma CVE-2022-03444.3An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.CVE-2022-03454.3The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users CVE-2022-03466.1The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thu CVE-2022-03476.1The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting i CVE-2022-03485.4Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.