Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

Affected Packages

Packagist moodle/moodle

Affected versions: 4.1.0 (fixed in 4.1.2)

Packagist moodle/moodle

Affected versions: 4.0.0 (fixed in 4.0.7)

Packagist moodle/moodle

Affected versions: 3.11.0 (fixed in 3.11.13)

Packagist moodle/moodle

Affected versions: 0 (fixed in 3.9.20)

Related CVEs

CVE-2023-28329

Key Information

GHSA ID

GHSA-72w2-j52c-7682

Published

March 23, 2023 9:30 PM

Last Modified

April 19, 2024 4:27 PM

CVSS Score

7.5 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 16, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.