~ / search / GHSA-9r26-5w88-qhp9

GHSA-9r26-5w88-qhp9

Authorization Bypass in moodle

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-25983

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.3.0, < 4.3.3 4.3.3
Packagist moodle/moodle >= 4.2.0, < 4.2.6 4.2.6
Packagist moodle/moodle < 4.1.9 4.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).

References

External links from the advisory. They lead to third-party sites.