← Vulnerability feed

Vulnerability record · CVE-2022-0332 · published 25 January 2022

CVE-2022-0332: Moodle h5p activity web service SQL injection

Moodle · Moodle

Moodle versions 3.11 to 3.11.4 contain an SQL injection flaw in the h5p activity web service that fetches user attempt data. Because the vulnerable endpoint is network-reachable and requires no authentication, it exposes the Moodle database to direct manipulation. The CVSS 3.1 base score is 9.8 (critical).

9.8 CVSS 3.1 Critical EPSS 45% · top 1.3% CWE-89 · SQL injection
9.8CVSS 3.1 base score, v2 7.5
45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and a high EPSS percentile, make this a top remediation priority despite no KEV listing.

What it is

Moodle versions 3.11 to 3.11.4 contain an SQL injection flaw in the h5p activity web service that fetches user attempt data. Because the vulnerable endpoint is network-reachable and requires no authentication, it exposes the Moodle database to direct manipulation. The CVSS 3.1 base score is 9.8 (critical).

Impact

An unauthenticated attacker can inject SQL through the h5p web service, potentially reading, altering, or deleting data in the Moodle database. Full compromise of confidentiality, integrity, and availability is scored.

Attack surface

Reached over the network via the h5p activity web service endpoint; the CVSS vector shows no privileges required and no user interaction. No authentication is needed to send the malicious request.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is 0.44918 (98.7th percentile), indicating elevated predicted exploitation activity.

What to do

  • Upgrade Moodle to a release after 3.11.4 that contains the vendor patch referenced in the Moodle advisory.
  • If immediate upgrade is not possible, restrict network access to the h5p activity web service endpoints to trusted clients only.
  • Review database account privileges used by Moodle and apply least privilege to limit injection impact.
  • Monitor the Moodle advisory and Red Hat Bugzilla 2043661 for updated guidance.

Detection

  • Inspect web server and Moodle logs for anomalous requests to h5p activity web service endpoints, especially those containing SQL metacharacters.
  • Enable and review database query logging for unexpected or malformed SQL originating from the Moodle application.
  • Alert on unusual data access patterns or errors from the h5p attempt-fetching code path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=2043661 Issue TrackingThird Party Advisory
https://moodle.org/mod/forum/discuss.php?d=431099 PatchVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2043661 Issue TrackingThird Party Advisory
https://moodle.org/mod/forum/discuss.php?d=431099 PatchVendor Advisory

Track CVE-2022-0332 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2019-3809Moodle cross-site request forgery vulnerabilityA flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, w…EPSS 0.86%10.0CVE-2006-4935Moodle improper input validation vulnerabilityThe Database module in Moodle before 1.6.2 does not properly handle uploaded files, which has unspecified impact and remote attack vectors.EPSS 1.5%10.0CVE-2006-4936Moodle improper input validation vulnerabilityMoodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote a…EPSS 1.5%10.0CVE-2005-2247Moodle vulnerabilityMultiple unknown vulnerabilities in Moodle before 1.5.1 have unknown impact and attack vectors.EPSS 1.5%10.0CVE-2004-2233Moodle vulnerabilityUnknown "front page vulnerability with Moodle servers" for Moodle before 1.3.2 has unknown impact and attack vectors.EPSS 1.7%10.0CVE-2004-2235Moodle vulnerabilityUnknown vulnerability in Moodle before 1.2 has unknown impact and attack vectors, related to improper filtering of text.EPSS 1.4%10.0CVE-2004-2236Moodle vulnerabilityUnknown vulnerability in Moodle before 1.3.3 has unknown impact and attack vectors, related to language setting.EPSS 1.4%10.0CVE-2004-2237Moodle vulnerabilityUnknown vulnerability in Moodle before 1.3.4 has unknown impact and attack vectors, related to "strings in Moodle texts."EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2022-0332), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.