Cross-Site Request Forgery Risk in H5P Libraries of Moodle by Moodle

CVE-2022-2986

What is CVE-2022-2986?

A vulnerability has been identified in Moodle's H5P libraries where enabling and disabling features lacked the necessary security token, leaving it susceptible to Cross-Site Request Forgery (CSRF) attacks. An attacker could exploit this weakness to perform unauthorized actions on behalf of a legitimate user, potentially compromising the integrity of the application.

References