GHSA-r4xr-m393-778m
Moodle IDOR when accessing list of course badges
At a glance
- Published
- Updated
- CVE
- CVE-2024-48899
- Aliases
- BIT-moodle-2024-48899
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-48899 ADVISORY
- https://github.com/moodle/moodle/commit/07ad4b8ebc715056056e01f2175820bfce6b290f WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2318819 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=462878#p1858337 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |