Incorrect Group Restrictions in H5P Attempts Report
CVE-2024-25980

5.3MEDIUM

Key Information:

Vendor

Fedora

Status
Moodle
4.2.6
Fedora
Extra Packages For Enterprise Linux
Vendor
CVE Published:
19 February 2024

What is CVE-2024-25980?

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

Affected Version(s)

4.2.6 and 4.1.9

moodle 4.3.3

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=...
https://bugzilla.redhat.com/show_bug.cgi?id=2264096
issue-trackingx_refsource_REDHAT
https://moodle.org/mod/forum/discuss.php?d=455636

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Leon Stringer for reporting this issue.
.