GHSA-j822-x5gg-5r56
Moodle allows users to retrieve information they did not have permission to access
At a glance
- Published
- Updated
- CVE
- CVE-2024-45689
- Aliases
- BIT-moodle-2024-45689
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.13 |
| Packagist · moodle/moodle | introduced 4.2.0-beta, fixed 4.2.10 |
| Packagist · moodle/moodle | introduced 4.3.0-beta, fixed 4.3.7 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45689 ADVISORY
- https://github.com/moodle/moodle/commit/bb466df202a4b4a692006298f93cbba20566949c WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2309941 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=461894#p1854491 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |