medium6.5
CVE-2024-45689
Moodle allows users to retrieve information they did not have permission to access
Impact
A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | < 4.1.13 | 4.1.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 4.1.13 from 4.2.0 before 4.2.10 from 4.3.0 before 4.3.7 from 4.4.0 before 4.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2309941
- https://github.com/advisories/GHSA-j822-x5gg-5r56
- https://nvd.nist.gov/vuln/detail/CVE-2024-45689
- https://github.com/moodle/moodle/commit/bb466df202a4b4a692006298f93cbba20566949c
- https://moodle.org/mod/forum/discuss.php?d=461894#p1854491