Read the docs
TI-2022-12739 Aliases CVE-2022-30600GHSA-w37f-pvvx-wcwm

A flaw was found in moodle where logic used to count failed login attempts could result…

Priority MEDIUM 50CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.

Why it matters now

EPSS 0.05061 92nd percentileScored 2026-11-07
Fix Fixed moodle/moodle (Packagist): 4.0.1, 3.9.14, 3.10.11 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—moodleAffects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions—No fix listedCNA
—moodle/moodle (Packagist)4.0 to before 4.0.14.0.1Patch availableGHSA-w37f-pvvx-wcwm
—moodle/moodle (Packagist)3.9 to before 3.9.143.9.14Patch availableGHSA-w37f-pvvx-wcwm
—moodle/moodle (Packagist)3.10 to before 3.10.113.10.11Patch availableGHSA-w37f-pvvx-wcwm
—moodle/moodle (Packagist)3.11 to before 3.11.73.11.7Patch availableGHSA-w37f-pvvx-wcwm
  • moodle Vendor— Affected Affects : 4.0, 3.11 to 3.11.6, 3.10 to 3.10.10, 3.9 to 3.9.13 and earlier unsupported versions Fixed in — No fix listed CNA
  • moodle/moodle (Packagist) Vendor— Affected 4.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-w37f-pvvx-wcwm
  • moodle/moodle (Packagist) Vendor— Affected 3.9 to before 3.9.14 Fixed in 3.9.14 Patch available GHSA-w37f-pvvx-wcwm
  • moodle/moodle (Packagist) Vendor— Affected 3.10 to before 3.10.11 Fixed in 3.10.11 Patch available GHSA-w37f-pvvx-wcwm
  • moodle/moodle (Packagist) Vendor— Affected 3.11 to before 3.11.7 Fixed in 3.11.7 Patch available GHSA-w37f-pvvx-wcwm

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*3.9 to before 3.9.14; 3.10 to before 3.10.11; 3.11 to before 3.11.7VulnerableMoodle
cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:*4.0.0VulnerableMoodle
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
  • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* Versions 3.9 to before 3.9.14; 3.10 to before 3.10.11; 3.11 to before 3.11.7 Vulnerable ·Moodle
  • cpe:2.3:a:moodle:moodle:4.0.0:-:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Moodle
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-w37f-pvvx-wcwm moodle/moodle (Packagist) Fixed in 4.0.1 Advisory →
  • Fix · GHSA-w37f-pvvx-wcwm moodle/moodle (Packagist) Fixed in 3.9.14 Advisory →
  • Fix · GHSA-w37f-pvvx-wcwm moodle/moodle (Packagist) Fixed in 3.10.11 Advisory →
  • Fix · GHSA-w37f-pvvx-wcwm moodle/moodle (Packagist) Fixed in 3.11.7 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    moodle — FEDORA-2022-bd4457bcc4

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-12738 A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.Priority MEDIUM 45
    • TI-2022-12736 A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.Priority LOW 27
    • TI-2022-12735 Cross-site scripting in moodlePriority LOW 26
    Show all 5 records → Advisory →
  • Advisory ·

    moodle — FEDORA-2022-89bfefbe48

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-12738 A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.Priority MEDIUM 45
    • TI-2022-12736 A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.Priority LOW 27
    • TI-2022-12735 Cross-site scripting in moodlePriority LOW 26
    Show all 5 records → Advisory →
Show 1 more group
  • Advisory ·

    moodle — FEDORA-2022-530fdc5202

    5 records Highest priority Priority MEDIUM 2 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2022-12738 A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.Priority MEDIUM 45
    • TI-2022-12736 A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.Priority LOW 27
    • TI-2022-12735 Cross-site scripting in moodlePriority LOW 26
    Show all 5 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30600
  2. 2026-10-03 Alias added: GHSA-w37f-pvvx-wcwm

References

Patch 1

Advisory 6

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences