CVE-2022-0983

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	moodle	moodle 3.11.6, moodle 3.10.10, moodle 3.9.13

References

https://bugzilla.redhat.com/show_bug.cgi?id=2064119Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y/
https://bugzilla.redhat.com/show_bug.cgi?id=2064119Issue Tracking, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y/

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-09844.3Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile f CVE-2022-09854.3Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary m CVE-2022-09866.1Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.CVE-2022-09873.3A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local CVE-2022-09887.5Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTT CVE-2022-09897.5An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide ma CVE-2022-09909.1Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.CVE-2022-09917.1Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.CVE-2022-09929.8The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr CVE-2022-09939.8The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administr CVE-2022-09944.8The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as CVE-2022-09957.8An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite p