GitHub Advisoryadvisory · Packagist

GHSA-cp8m-h777-g4p3 Improper Access Control in moodle

MEDIUM Published 2024-02-19 Modified 2025-01-23 Official page ↗
Aliases
CVE-2024-25980
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2024-02-21

Affected packages

• Packagist moodle/moodle: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • Packagist moodle/moodle: >= 4.2.0, < 4.2.6 → fixed in 4.2.6 • Packagist moodle/moodle: < 4.1.9 → fixed in 4.1.9

Description

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

Related

Alias · CVE (1)

  • CVE-2024-25980 Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References