Description

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

Remediation

References

CVE-2022-0984

Related Vulnerabilities

Joomla! Core 1.6.x Cross-Site Scripting (1.6.0 - 1.6.6)

WordPress Plugin Smart Email Alerts Cross-Site Scripting (1.0.10)

Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2015-5608)

Moodle Improper Input Validation Vulnerability (CVE-2011-4302)

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-10352)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-863 CVE-2022-0984