SQL injection in Moodle

CRITICAL 9.8CVE-2022-0332 · BIT-moodle-2022-0332 · GHSA-6jhm-4vmx-mr76 · Published 25/01/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 3.11, < 3.11.5`	`3.11.5`
moodle moodle	`≥ 3.11.0, < 3.11.5`	`3.11.5`

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

NVD description

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

References

nvd.nist.gov/vuln/detail/CVE-2022-0332 · ADVISORY
moodle/moodle commit c7a62a8 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
moodle/moodle · WEB
moodle.org/mod/forum/discuss.php · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free