CVE-2022-30600

highpriority · attend · 51EPSS 0.050 · 92 %ileexploit · PoCEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

4.97% (92nd) EPSS

CVSS 7.5 · high

Is it mine?

26 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-682USprimaryCWE-307USCWE-682USCWE-682US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Boonjune/POC-CVE-2022-30600A proof of concept for CVE-2022-30600PoC · poc_in_github

affected products (26)

Products and version ranges known to be affected.

n/a Moodle≤ Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versionsenisa_euvdEU
Fedora Project Fedora≤ 34fstec_bduRU
Fedora Project Fedora≤ 36fstec_bduRU
Fedora Project Fedora≤ 35fstec_bduRU
Мартин Догиамас Moodle≤ 3.9.14fstec_bduRU
Мартин Догиамас Moodle3.10.0 → 3.10.11fstec_bduRU
Мартин Догиамас Moodle3.11.0 → 3.11.7fstec_bduRU
Мартин Догиамас Moodle4.0.0 → 4.0.1fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ФССП России ОС ТД АИС ФССП России≤ ИК6fstec_bduRU
fedoraproject fedora= 34nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 35nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 36nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
moodle moodle3.10 → 3.10.11nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle3.11 → 3.11.7nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle3.9 → 3.9.14nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
moodle moodle= 4.0.0nvdUScpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
redhat enterprise linux= 8.0nvdUScpe:2.3:o:redhat:enterprise_linux:*:*:*:*:*:*:*:*
Bitnami moodle3.10.0 → 3.10.11osvUSpkg:bitnami/moodle
Bitnami moodle3.11.0 → 3.11.7osvUSpkg:bitnami/moodle

showing 20 of 26

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-w37f-pvvx-wcwmIncorrect Calculation in moodle2022-05-19ghsa · osvUS
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
BIT-moodle-2022-306002024-03-06vendor · osvUS
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

published 2022-05-18modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-30780US	high7.5	57.2% (99th)	Exploit	2022-06-11
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c h…
CVE-2016-0777US	medium6.5	63.5% (99th)	Exploit	2016-01-14
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by r…
CVE-2017-7376US	critical9.8	23.0% (98th)	Exploit	2018-02-19
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2021-45960US	high8.8	4.67% (92nd)	Exploit	2022-01-01
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, o…
CVE-2020-0022US	high8.8	6.05% (93rd)	Exploit	2020-02-13
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Blue…

+249 more

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan