GitHub Advisoryadvisory · Packagist

GHSA-c5hf-mc85-2hx4 Missing authorization in Moodle

MEDIUM Published 2022-04-30 Modified 2022-05-24 Official page ↗
Aliases
CVE-2022-0984
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-863
Reviewed
2022-05-24

Affected packages

• Packagist moodle/moodle: >= 3.11.0, < 3.11.6 → fixed in 3.11.6 • Packagist moodle/moodle: >= 3.10.0, < 3.10.10 → fixed in 3.10.10 • Packagist moodle/moodle: < 3.9.13 → fixed in 3.9.13

Description

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

Related

Alias · CVE (1)

  • CVE-2022-0984 Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References