Medium
Moodle: minor sql injection risk on mnet sso access control page
Type: advisorySources: OSV
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-35132
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 11:15 UTC · Revision 1
Source evidence
Moodle: minor sql injection risk on mnet sso access control page
core-osv · Original sourcePublished 22 Jun 2023, 00:00 UTC
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
osv:CVE-2023-35132
Complete source record
{
"id": "b1309b511318b9b0364adc93c9f52b96928d71986a4a4a8f291ad8c683d40113",
"url": "https://osv.dev/vulnerability/CVE-2023-35132",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Moodle: minor sql injection risk on mnet sso access control page",
"summary": "A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.",
"evidence": "osv:CVE-2023-35132",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-35132",
"aliases": [
"BIT-moodle-2023-35132",
"CVE-2023-35132",
"GHSA-49mv-vfcp-8gg9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1c40a5e03065d0d784d020890a8e494bf9e5112c"
},
{
"introduced": "94f2d3fc4b974c5c7d500988c56b7ca15f58d7ec"
},
{
"fixed": "bfbae65caac00b3d4cfcdc3c8b8a18f66f3121f5"
},
{
"introduced": "8b359ad7a63cf219110bca80552fe3d4ea2a635d"
},
{
"fixed": "19c271d45ee1ab62df60295df54020a09b493b41"
},
{
"introduced": "0ea3d45e04c3d54a3a472ddcb11606b30e227c50"
},
{
"fixed": "76fe404dd5fca357152e9f71ae4800f557343486"
},
{
"introduced": "ae4efa96ee8169a848c141ad21690165ea791552"
},
{
"last_affected": "ae4efa96ee8169a848c141ad21690165ea791552"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.9.22"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.11.0"
},
{
"fixed": "3.11.15"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:4.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0"
},
{
"last_affected": "4.2.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"4.2.0",
"v3.11.14",
"v3.9.21",
"v4.2.0",
"v4.0.8",
"v4.1.3",
"v4.0.7",
"v4.1.2",
"v3.11.13",
"v3.9.20",
"v4.0.6",
"v4.1.1",
"v3.9.19",
"v3.11.12",
"v4.1.0",
"v3.9.18",
"v3.11.11",
"v4.0.5",
"v3.11.10",
"v3.9.17",
"v4.0.4",
"v3.9.16",
"v3.11.9",
"v4.0.3",
"v4.0.2",
"v3.11.8",
"v3.9.15",
"v3.9.14",
"v4.0.1",
"v3.11.7",
"v4.0.0",
"v3.11.6",
"v3.9.13",
"v3.11.5",
"v3.9.12",
"v3.11.4",
"v3.9.11",
"v3.11.3",
"v3.9.10",
"v3.11.1",
"v3.11.2",
"v3.9.9",
"v3.9.8",
"v3.11.0",
"v3.9.7",
"v3.9.6",
"v3.9.5",
"v3.9.4",
"v3.9.3",
"v3.9.2",
"v3.9.1",
"v3.9.0-rc2",
"v3.9.0",
"v3.9.0-rc3",
"v3.9.0-rc1",
"v3.9.0-beta",
"v3.8.0",
"v3.8.0-rc1",
"v3.8.0-beta",
"v3.7.0",
"v3.7.0-rc2",
"v3.7.0-rc1",
"v3.7.0-beta",
"v3.6.0",
"v3.6.0-rc2",
"v3.6.0-rc3",
"v3.6.0-rc1",
"v3.6.0-beta",
"v3.5.0",
"v3.5.0-rc1",
"v3.5.0-beta",
"v3.4.0",
"v3.4.0-rc2",
"v3.4.0-rc3",
"v3.4.0-rc1",
"v3.4.0-beta",
"v3.3.0",
"v3.3.0-rc3",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.3.0-beta",
"v3.2.0-rc2",
"v3.2.0",
"v3.2.0-rc4",
"v3.2.0-beta",
"v3.2.0-rc5",
"v3.2.0-rc3",
"v3.2.0-rc1",
"v3.1.0-beta",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35132.json"
}
}
],
"modified": "2026-10-28T02:30:28.029260398Z",
"provider": "osv",
"references": [
"https://git.moodle.org",
"https://moodle.org/mod/forum/discuss.php?d=447830",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35132.json",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/",
"https://nvd.nist.gov/vuln/detail/CVE-2023-35132",
"https://bugzilla.redhat.com/show_bug.cgi?id=2214371"
],
"provider_metadata": {
"cwe_ids": [
"CWE-89"
],
"cna_assigner": "fedora",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.1"
},
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.4"
},
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.9"
},
{
"introduced": "3.11.0"
},
{
"fixed": "3.11.15"
},
{
"fixed": "3.9.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35132.json"
}
},
"related_cves": [
{
"value": "CVE-2023-35132",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494875,
"published_at": "2023-06-22T00:00:00+00:00"
}