CVE-2022-40314
Published: 30 September 2022
Summary
CVE-2022-40314 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Moodle Moodle. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A remote code execution vulnerability tracked as CVE-2022-40314 affects Moodle when processing backup files that originate from version 1.9. The issue stems from unsafe deserialization of untrusted data (CWE-502), allowing an attacker-supplied backup archive to execute arbitrary code during the restore process. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated attacker can supply a specially crafted Moodle 1.9 backup file to any instance that accepts restores, achieving full remote code execution with the privileges of the web server process. This enables complete compromise of confidentiality, integrity, and availability of the affected Moodle installation and any data it processes.
Moodle security advisories and associated Red Hat bug reports recommend applying the patches released for supported branches and avoiding restoration of legacy 1.9 backups until they can be verified or converted through a trusted intermediate version. The EPSS score for this CVE reached a peak of 0.0978 after disclosure, indicating a measurable increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6989
Vulnerability details
A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.