An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
{
"severity": "High",
"cpes": [
"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"
]
}