Every CVE Search/ Get API key

CVE-2022-40315

Moodle Minor SQL injection risk in admin user browsing

9.8 CriticalFix available

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.11%Up 0.2 points since Oct 1, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
CVE-2022-40315
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
CVE List 9.8

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
CVE-2022-40315
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2022-7134 9.8

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
EUVD-2022-7134
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mqw9-3cjm-xwp3 9.8

Moodle Minor SQL injection risk in admin user browsing

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
GHSA-mqw9-3cjm-xwp3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 9.8

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
CVE-2022-40315
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-mqw9-3cjm-xwp3 9.8

Moodle Minor SQL injection risk in admin user browsing

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
GHSA-mqw9-3cjm-xwp3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSVUBUNTU-CVE-2022-40315 9.8

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
UBUNTU-CVE-2022-40315
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-moodle-2022-40315 No score

A limited SQL injection risk was identified in the "browse list of users" site administration page.

Record
BIT-moodle-2022-40315
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
moodle/moodle
Packagist
 3.9 up to 3.9.17
3.9.17
moodle/moodle
Packagist
 3.11 up to 3.11.10
3.11.10
moodle/moodle
Packagist
 4.0 up to 4.0.4
4.0.4
moodle
Bitnami
 3.9.0 up to 3.9.17, 3.11.0 up to 3.11.10, 4.0.0 up to 4.0.4
3.9.173.11.104.0.4
moodle/moodle
Packagist
 3.9 up to 3.9.17, plus listed versions
v3.9.0v3.9.0-betav3.9.0-rc1v3.9.0-rc2v3.9.0-rc3
Show 16 moreShow less
v3.9.1v3.9.10v3.9.11v3.9.12v3.9.13v3.9.14v3.9.15v3.9.16v3.9.2v3.9.3v3.9.4v3.9.5v3.9.6v3.9.7v3.9.8v3.9.9
3.9.17
moodle/moodle
Packagist
 3.11 up to 3.11.10, plus listed versions
v3.11.0v3.11.0-betav3.11.0-rc1v3.11.0-rc2v3.11.1
Show 8 moreShow less
v3.11.2v3.11.3v3.11.4v3.11.5v3.11.6v3.11.7v3.11.8v3.11.9
3.11.10
moodle/moodle
Packagist
 4.0 up to 4.0.4, plus listed versions
v4.0.0v4.0.0-betav4.0.0-rc1v4.0.0-rc2v4.0.0-rc3
Show 4 moreShow less
v4.0.0-rc4v4.0.1v4.0.2v4.0.3
4.0.4
moodle
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known
moodle
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-40315 is a critical vulnerability (CVSS 9.8) in Moodle, published September 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in moodle/moodle 3.9.17.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open