Remote Code Execution Vulnerability in Moodle Product
CVE-2022-40314

9.8CRITICAL

Key Information:

Vendor

Moodle
Status
Moodle
Vendor
CVE Published:
30 September 2022

What is CVE-2022-40314?

A remote code execution vulnerability has been discovered in Moodle, specifically when restoring backup files from version 1.9. This flaw allows an attacker to execute arbitrary code on the server, posing a serious risk to users. It's essential for organizations using affected versions to implement security measures and apply any available patches to safeguard their systems.

Affected Version(s)

moodle 4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions

References

https://bugzilla.redhat.com/show_bug.cgi?id=2128147
x_refsource_MISC
https://moodle.org/mod/forum/discuss.php?d=438393
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.