CVE-2022-40314

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	moodle	4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=2128147Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=438393Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2128147Issue Tracking, Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=438393Patch, Vendor Advisory

Timeline

Published: Sep 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-403159.8A limited SQL injection risk was identified in the "browse list of users" site administration page.CVE-2022-403164.3The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers ab CVE-2022-403175.4OpenKM 6.3.11 allows stored XSS related to the javascript&colon; substring in an A element.CVE-2022-403186.5An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length CVE-2022-403197.5The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email addre CVE-2022-40326.1The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and in CVE-2022-403208.8cfg_tilde_expand in confuse.c in libConfuse 3.3 has a heap-based buffer over-read.CVE-2022-403226.1SysAid Help Desk before 22.1.65 allows XSS, aka FR# 66542 and 65579.CVE-2022-403236.1SysAid Help Desk before 22.1.65 allows XSS in the Password Services module, aka FR# 67241.CVE-2022-403246.1SysAid Help Desk before 22.1.65 allows XSS via the Linked SRs field, aka FR# 67258.CVE-2022-403256.1SysAid Help Desk before 22.1.65 allows XSS via the Asset Dashboard, aka FR# 67262.CVE-2022-40335.3The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to,