CVE-2023-35132: Moodle: minor sql injection risk on mnet sso access control page

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-22 · updated 2026-06-17
Weakness: CWE-89

Description

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

Affected products

Moodle: before 3.9.22; from 3.11.0 before 3.11.15; from 4.0.0 before 4.0.9; from 4.1.0 before 4.1.4; 4.2.0 — fixed in 3.11.15, 3.9.22, 4.0.9, 4.1.4

How to fix

Upgrade to a fixed version: Moodle 3.11.15, 3.9.22, 4.0.9, 4.1.4. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2214371
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
https://moodle.org/mod/forum/discuss.php?d=447830
https://bugzilla.redhat.com/show_bug.cgi?id=2214371
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/
https://moodle.org/mod/forum/discuss.php?d=447830

Get alerted when CVE-2023-35132 or the next vulnerability affects your stack