medium4.3
CVE-2023-1402
Moodle may display roles to users who don't have access to them
Impact
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.1.0, < 4.1.2 | 4.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | after 3.9.0 before 3.9.20 after 3.11.0 before 3.11.13 after 4.0.0 before 4.0.7 Versions 3.9.0, 3.11.0, 4.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2179427
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF/
- https://moodle.org/mod/forum/discuss.php?d=445069
- https://github.com/advisories/GHSA-vj5p-fp42-774p
- https://nvd.nist.gov/vuln/detail/CVE-2023-1402
- https://github.com/moodle/moodle/commit/f0a557bffbdb450648d0e4cedb391d14d8a0a253
- https://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=f0a557bffbdb450648d0e4cedb391d14d8a0a253
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF