BIT-moodle-2023-28329

vendorUSosv

Moodle: authenticated sql injection via availability check

view advisory published 2024-03-06Licence: per source

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-28329US	high8.8	1.20% (68th)	—	2023-03-23
Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=2179406WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/WEB
https://moodle.org/mod/forum/discuss.php?d=445061ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-28329WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan