GitHub Advisoryadvisory · Packagist

GHSA-prrh-679x-79qh Moodle allows remote authenticated users to reassign notes

MEDIUM Published 2022-05-13 Modified 2024-01-22 Official page ↗
Aliases
CVE-2013-1834
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2024-01-22

Affected packages

• Packagist moodle/moodle: >= 1.9.0, < 2.2.8 → fixed in 2.2.8 • Packagist moodle/moodle: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • Packagist moodle/moodle: >= 2.4.0, < 2.4.2 → fixed in 2.4.2

Description

notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.

Related

Alias · CVE (1)

  • CVE-2013-1834 notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References