~ / search / GHSA-cp8m-h777-g4p3

GHSA-cp8m-h777-g4p3

Improper Access Control in moodle

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-25980

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.3.0, < 4.3.3 4.3.3
Packagist moodle/moodle >= 4.2.0, < 4.2.6 4.2.6
Packagist moodle/moodle < 4.1.9 4.1.9

Details

As written in the advisory (Markdown source, shown as plain text).

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

References

External links from the advisory. They lead to third-party sites.