medium5.3
CVE-2024-25980
Improper Access Control in moodle
Impact
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.3.0, < 4.3.3 | 4.3.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 4.1.0 before 4.1.9 from 4.2.0 before 4.2.6 from 4.3.0 before 4.3.3 |
| Fedoraproject | Fedora | Version 38 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
- https://bugzilla.redhat.com/show_bug.cgi?id=2264096
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/
- https://moodle.org/mod/forum/discuss.php?d=455636
- https://github.com/advisories/GHSA-cp8m-h777-g4p3
- https://nvd.nist.gov/vuln/detail/CVE-2024-25980
- https://github.com/moodle/moodle/commit/662192fcecdefdaae79f55db96bd64dbcdeef85b
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB