{"id":"CVE-2022-28986","title":"LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone n…","summary":"LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone n…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-639"],"vendor":"lmsdoctor","product":"2_factor_authentication","affected":["2_factor_authentication = 2021072900"],"published":"2022-05-10","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-28986","references":[{"url":"https://github.com/FlaviuPopescu/CVE-2022-28986","label":"cve@mitre.org"},{"url":"http://lms.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://simple.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/FlaviuPopescu/CVE-2022-28986","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.023,"epssPercentile":0.82546,"ingestedAt":"2026-07-06T02:09:23.489Z","exploits":{"github":1,"githubRepos":["https://github.com/FlaviuPopescu/CVE-2022-28986"],"checkedAt":"2026-09-23T07:13:23.117Z"},"exploitAvailable":true,"slug":"CVE-2022-28986","body":"## Overview\n\nLMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.\n\n## Affected\n\n- `2_factor_authentication = 2021072900`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4616,"id":"CVE-2022-28986","ts":1788887194056,"field":"exploit_available","old":"false","new":"true"},{"seq":3499,"id":"CVE-2022-28986","ts":1788886310494,"field":"exploit_available","old":"true","new":"false"},{"seq":2353,"id":"CVE-2022-28986","ts":1788882979971,"field":"exploit_available","old":"false","new":"true"},{"seq":1382,"id":"CVE-2022-28986","ts":1788882392600,"field":"exploit_available","old":"true","new":"false"},{"seq":496,"id":"CVE-2022-28986","ts":1788881828449,"field":"exploit_available","old":"false","new":"true"}]}