VDB
GHSA-f9m9-494r-w36p
GHSA-f9m9-494r-w36p
PUBLISHED
Moodle allows bypass of intended access restrictions
Record from GitHub Advisory Database · Published May 13, 2022
moodle/moodle is fixed in 2.6.2, 2.5.5 and 2.4.9 (Packagist)
Moodle allows bypass of intended access restrictions
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| moodle/moodle | Packagist | 2.6.2, 2.5.5, 2.4.9 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| moodle | moodle | 2.5.0, 2.6.0, 0 |
Timeline
- May 13, 2022 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-f9m9-494r-w36p
vulnetix vdb fixes GHSA-f9m9-494r-w36pOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-f9m9-494r-w36p/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/moodle/moodle/commit/4d4867503c2467cb04660d9cb314d22f56004054 url
- https://github.com/moodle/moodle/commit/7748e17207b1a28118d9dc622878da22f956d3fe url
- https://moodle.org/mod/forum/discuss.php?d=256418 url
- https://github.com/moodle/moodle package
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-44082 url
- https://nvd.nist.gov/vuln/detail/CVE-2014-0122 advisory
- https://github.com/moodle/moodle/commit/3d7810ab3d67a423a760ba89ae75de81d940b236 url
- https://github.com/moodle/moodle/commit/5c45ea0c6bf2fdf4dddfaef9fc5ff12e6b426a3f url
- http://openwall.com/lists/oss-security/2014/03/17/1 url