GitHub Advisoryadvisory · Packagist

GHSA-45rw-4r25-jvg7 Moodle Logged in users could view all calendar events

MEDIUM Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2019-3848
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.4, < 3.4.8 → fixed in 3.4.8 • Packagist moodle/moodle: >= 3.5, < 3.5.5 → fixed in 3.5.5 • Packagist moodle/moodle: >= 3.6, < 3.6.3 → fixed in 3.6.3

Description

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)

Related

Alias · CVE (1)

  • CVE-2019-3848 A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References