CVE-2022-0335

HIGH

Moodle < 3.8.9 and 3.11 < 3.11.5 - Cross-Site Request Forgery in Badge Alignment Deletion

Title source: llm

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

References (2)

Core 2

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://bugzilla.redhat.com/show_bug.cgi?id=2043666

Vendor Advisory x_refsource_misc

https://moodle.org/mod/forum/discuss.php?d=431103

Scores

CVSS v3 8.8

EPSS 0.0011

EPSS Percentile 28.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (2)

moodle/moodle < 3.8.9

moodle/moodle 3.11 - 3.11.5Packagist

Published Jan 25, 2022

Tracked Since Feb 18, 2026