High severity · published Mar 25, 2022
CVE-2022-0983
An SQL injection risk was identified in Badges code relating to configuring criteria
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Extra Packages For Enterprise Linux · Fedoraproject
7.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36 · source: NVD
MO
Moodle · Moodle
3.9.0 before 3.9.13; 3.10.0 before 3.10.10; 3.11.0 before 3.11.6 · source: NVD
Affected product
EP
Extra Packages For Enterprise Linux
Fedoraproject
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0983
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2064119
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y/
More from Extra Packages For Enterprise Linux
8.8
CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability
9.8
CVE-2023-6395
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges
9.8
CVE-2023-5550
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the…
9.8
CVE-2023-34152
A vulnerability was found in ImageMagick
9.8
CVE-2022-4170
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and…