Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.

Remediation

References

CVE-2022-0335

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Cross-Site Scripting (2.9.18)

IBM RTC Server-Side Request Forgery (SSRF) Vulnerability (CVE-2020-4974)

MySQL Deserialization of Untrusted Data Vulnerability (CVE-2019-14540)

Moodle Other Vulnerability (CVE-2006-4937)

Drupal CVE-2018-14773 Vulnerability (CVE-2018-14773)

Severity

High

Classification

CVE-2022-0335 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities