GHSA-g8r3-2v89-j6r5
Moodle IDOR when accessing list of badge recipients
At a glance
- Published
- Updated
- CVE
- CVE-2024-48900
- Aliases
- BIT-moodle-2024-48900
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.4.0, fixed 4.4.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-48900 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2318818 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=462879 WEB
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83178 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |