GitHub Advisoryadvisory · Packagist

GHSA-g8r3-2v89-j6r5 Moodle IDOR when accessing list of badge recipients

MEDIUM Published 2024-11-13 Modified 2024-11-13 Official page ↗

Aliases: CVE-2024-48900
Ecosystem: Packagist
Packages: moodle/moodle
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-200
Reviewed: 2024-11-13

Affected packages

• Packagist moodle/moodle: >= 4.4.0, < 4.4.4 → fixed in 4.4.4

Description

A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Alias · CVE (1)

CVE-2024-48900 A vulnerability was found in Moodle. vulnerability

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References