GHSA-26fg-v32r-h663
Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | < 4.3.0-rc2 | 4.3.0-rc2 |
Details
As written in the advisory (Markdown source, shown as plain text).
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-5545
- https://github.com/moodle/moodle/commit/100ac7c6467a7de2c05713a0a924984ff1593d53
- https://bugzilla.redhat.com/show_bug.cgi?id=2243444
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=451586
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78820