CVE-2022-40316

Published: Sep 30, 2022Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

Affected (6)

Products: Moodle: Moodle · Fedoraproject: Extra Packages For Enterprise Linux, Fedora

Moodle

1 product

Moodle

Fedoraproject

2 products

Extra Packages For Enterprise Linux

Fedora

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	From 3.11.0 to 3.11.10
Moodle Moodle	From 3.9.0 to 3.9.17
Moodle Moodle	From 4.0.0 to 4.0.4

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Extra Packages For Enterprise Linux	Version 8.0
Fedoraproject Fedora	Version 35
Fedoraproject Fedora	Version 36

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=2128151

Source: patrick@puiterwijk.org

Issue TrackingPatchThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=438395

Source: patrick@puiterwijk.org

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2128151

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://moodle.org/mod/forum/discuss.php?d=438395

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.