low3.3
CVE-2023-5551
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Impact
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.3.0-beta, < 4.3.0-rc2 | 4.3.0-rc2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 3.9.24 from 3.11.0 before 3.11.17 from 4.0.0 before 4.0.11 from 4.1.0 before 4.1.6 from 4.2.0 before 4.2.3 |
| Fedoraproject | Extra Packages For Enterprise Linux | Version 7.0 |
| Fedoraproject | Fedora | Version 38 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310
- https://bugzilla.redhat.com/show_bug.cgi?id=2243453
- https://moodle.org/mod/forum/discuss.php?d=451592
- https://github.com/advisories/GHSA-jr83-8x65-xcr5
- https://nvd.nist.gov/vuln/detail/CVE-2023-5551
- https://github.com/moodle/moodle/commit/2bb6c551cf2e7be29857db35388911b8179394b0
- https://github.com/moodle/moodle/commit/6de45d2c9f7dd7b24210ab0310c296366a82986a
- https://github.com/moodle/moodle/commit/b91feb0b2328cdda2561d68b8dfe2a129190bc85