CVE-2022-0332

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 44.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-25 · updated 2026-06-17
Weakness: CWE-89

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

Affected products

Moodle: from 3.11.0 before 3.11.5 — fixed in 3.11.5

How to fix

Upgrade to a fixed version: Moodle 3.11.5. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2043661
https://moodle.org/mod/forum/discuss.php?d=431099
https://bugzilla.redhat.com/show_bug.cgi?id=2043661
https://moodle.org/mod/forum/discuss.php?d=431099

Get alerted when CVE-2022-0332 or the next vulnerability affects your stack