Description

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.

Remediation

References

CVE-2022-0985

Related Vulnerabilities

WordPress Plugin Rate my Post-WP Rating System Cross-Site Scripting (3.3.8)

WordPress Plugin Ultimate Instagram Feed Cross-Site Scripting (1.2)

Oracle Application Server Other Vulnerability (CVE-2005-3449)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-28979)

Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-24554)

Severity

Medium

Classification

CVE-2022-0985 CWE-287 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities