CVE-2022-0983
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
CVE-2022-0983- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
CVE-2022-0983- Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2022-1433 No score
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
EUVD-2022-1433- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h2fw-93qx-vrcq
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
GHSA-h2fw-93qx-vrcq- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-h2fw-93qx-vrcq
SQL Injection in Moodle
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
GHSA-h2fw-93qx-vrcq- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0983
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
UBUNTU-CVE-2022-0983- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-moodle-2022-0983 No score
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
BIT-moodle-2022-0983- Updated
- 2026-11-02
OSV No score
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
- Record
CVE-2022-0983- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
3.11.0 up to 3.11.6 | 3.11.6 |
moodle/moodlePackagist |
3.10.0 up to 3.10.10 | 3.10.10 |
moodle/moodlePackagist |
before 3.9.13 | 3.9.13 |
moodleBitnami |
3.9.0 up to 3.9.13, 3.10.0 up to 3.10.10, 3.11.0 up to 3.11.6 | 3.9.133.10.103.11.6 |
moodle/moodlePackagist |
3.11.0 up to 3.11.6, plus listed versions v3.11.0v3.11.1v3.11.2v3.11.3v3.11.4v3.11.5 |
3.11.6 |
moodle/moodlePackagist |
3.10.0 up to 3.10.10, plus listed versions v3.10.0v3.10.1v3.10.2v3.10.3v3.10.4 Show 5 moreShow lessv3.10.5v3.10.6v3.10.7v3.10.8v3.10.9 |
3.10.10 |
moodle/moodlePackagist |
before 3.9.13, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
3.9.13 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0983 is a high vulnerability (CVSS 8.8) in Moodle, published March 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in moodle/moodle 3.11.6.
References
bugzilla.redhat.com/show_bug.cgi?id=2064119
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y
nvd.nist.gov/vuln/detail/CVE-2022-0983
github.com/moodle/moodle/commit/c2794752ea3cdda2d64a0651da08b2cdf730d9f1
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-74074
Left out here: 210 versions. The JSON record has them.