CVE-2022-0334
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
CVE-2022-0334- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-863, CWE-668
- Updated
- 2026-11-02
CVE List No score
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
CVE-2022-0334- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-0540 No score
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
EUVD-2022-0540- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-93pj-4p65-qmr9
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
GHSA-93pj-4p65-qmr9- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-668, CWE-863
- Updated
- 2026-11-02
OSVGHSA-93pj-4p65-qmr9
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
GHSA-93pj-4p65-qmr9- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-668, CWE-863
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0334
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
UBUNTU-CVE-2022-0334- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2022-0334 No score
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
BIT-moodle-2022-0334- Updated
- 2026-11-02
OSV No score
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
- Record
CVE-2022-0334- Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
3.11 up to 3.11.5 | 3.11.5 |
moodle/moodlePackagist |
3.10 up to 3.10.8 | 3.10.8 |
moodle/moodlePackagist |
before 3.9.11 | 3.9.11 |
moodleBitnami |
before 3.8.10, 3.9.0 up to 3.9.12, 3.10.0 up to 3.10.9, 3.11.0 up to 3.11.5 | 3.8.103.9.123.10.93.11.5 |
moodle/moodlePackagist |
3.11 up to 3.11.5, plus listed versions v3.11.0v3.11.0-betav3.11.0-rc1v3.11.0-rc2v3.11.1v3.11.2v3.11.3v3.11.4 |
3.11.5 |
moodle/moodlePackagist |
3.10 up to 3.10.8, plus listed versions v3.10.0v3.10.0-betav3.10.0-rc1v3.10.0-rc2v3.10.1 Show 6 moreShow lessv3.10.2v3.10.3v3.10.4v3.10.5v3.10.6v3.10.7 |
3.10.8 |
moodle/moodlePackagist |
before 3.9.11, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
3.9.11 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0334 is a medium vulnerability (CVSS 4.3) in Moodle, published January 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in moodle/moodle 3.11.5.
References
bugzilla.redhat.com/show_bug.cgi?id=2043664
moodle.org/mod/forum/discuss.php?d=431102
nvd.nist.gov/vuln/detail/CVE-2022-0334
github.com/moodle/moodle/commit/1964d68f8500ea3c7b776fa8a2af6266ed109f84
ubuntu.com/security/CVE-2022-0334
cve.org/CVERecord?id=CVE-2022-0334
Left out here: 208 versions. The JSON record has them.