GHSA-m434-m5pv-p35w
Insufficient user authorization in Moodle
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 3.11, < 3.11.5 | 3.11.5 |
| Packagist | moodle/moodle | >= 3.10, < 3.10.8 | 3.10.8 |
| Packagist | moodle/moodle | >= 3.9, < 3.9.11 | 3.9.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
References
External links from the advisory. They lead to third-party sites.