GitHub Advisoryadvisory · Packagist

GHSA-j822-x5gg-5r56 Moodle allows users to retrieve information they did not have permission to access

MEDIUM Published 2024-11-20 Modified 2025-06-04 Official page ↗
Aliases
CVE-2024-45689
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-285, CWE-862
Reviewed
2024-11-20

Affected packages

• Packagist moodle/moodle: < 4.1.13 → fixed in 4.1.13 • Packagist moodle/moodle: >= 4.2.0-beta, < 4.2.10 → fixed in 4.2.10 • Packagist moodle/moodle: >= 4.3.0-beta, < 4.3.7 → fixed in 4.3.7 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.3 → fixed in 4.4.3

Description

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-862 Missing Authorization weakness

References