CVE-2022-0332

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

Affected

moodle

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

44.01% chance of exploitation in the next 30 days, 99th percentile

Published

2022-01-25

Updated

2024-08-02

Proof-of-concept exploits (2)

• numanturle/CVE-2022-033246★ · 2022-01-26
• vuductruong12/KTLHPM0★ · 2025-11-27

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50700

Security advisories

• https://moodle.org/mod/forum/discuss.php?d=431099
• https://bugzilla.redhat.com/show_bug.cgi?id=2043661
• advisories/GHSA-6jhm-4vmx-mr76

References

• CVE Record
• NVD entry

Related

• CVE-2021-23758
• CVE-2021-41773
• CVE-2021-42008
• CVE-2021-43789
• CVE-2021-44228
• CVE-2022-1388