Skip to main content

External Control of Assumed-Immutable Web Parameter

CVE-2022-30597

Medium
5.3/10

Summary

A flaw was found in moodle prior to 3.9.14, 3.10.x prior to 3.10.11, 3.11.x prior to 3.11.7 and 4.0.x prior to 4.0.1 where the description user field was not hidden when being set as a hidden user field.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-472 - External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

References

Advisory Timeline

  • Published