medium5.3
CVE-2024-48900
Moodle IDOR when accessing list of badge recipients
Impact
A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.4.0, < 4.4.4 | 4.4.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 4.4.0 before 4.4.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2318818
- https://github.com/advisories/GHSA-g8r3-2v89-j6r5
- https://nvd.nist.gov/vuln/detail/CVE-2024-48900
- https://moodle.org/mod/forum/discuss.php?d=462879
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83178