GitHub Advisoryadvisory · Packagist

GHSA-5p2x-8427-9fgp Moodle Improper Access Control vulnerability

MEDIUM Published 2024-02-12 Modified 2024-02-12 Official page ↗
Aliases
CVE-2024-1439
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2024-02-12

Affected packages

• Packagist moodle/moodle: <= 4.2.0 (no fix yet)

Description

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.

Related

Alias · CVE (1)

  • CVE-2024-1439 Inadequate access control in Moodle LMS. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References