GitHub Advisoryadvisory · Packagist

GHSA-xjx9-7c29-pwmm Moodle Improper Privilege Management

MEDIUM Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-1134
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-269
Reviewed
2024-04-23

Affected packages

• Packagist moodle/moodle: >= 3.1, < 3.1.12 → fixed in 3.1.12 • Packagist moodle/moodle: >= 3.2, < 3.2.9 → fixed in 3.2.9 • Packagist moodle/moodle: >= 3.3, < 3.3.6 → fixed in 3.3.6 • Packagist moodle/moodle: >= 3.4, < 3.4.3 → fixed in 3.4.3

Description

An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.

Related

Alias · CVE (1)

  • CVE-2018-1134 An issue was discovered in Moodle 3.x. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References