Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Remediation

References

CVE-2022-0335

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-40605)

WordPress Plugin Import Export WordPress Users Security Bypass (1.3.8)

MyBB CVE-2006-0218 Vulnerability (CVE-2006-0218)

WordPress Plugin Google AdSense Click-Fraud Monitoring Cross-Site Scripting (1.8.6)

Zope Web Application Server Other Vulnerability (CVE-2002-0170)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-352 CVE-2022-0335