GHSA-g8r3-2v89-j6r5

Source

https://github.com/advisories/GHSA-g8r3-2v89-j6r5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-g8r3-2v89-j6r5/GHSA-g8r3-2v89-j6r5.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-g8r3-2v89-j6r5

Aliases

CVE-2024-48900

Published

2024-11-13T15:31:37Z

Modified

2024-11-13T18:57:31.206958Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Moodle IDOR when accessing list of badge recipients

Details

A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Database specific

{
    "nvd_published_at": "2024-11-13T15:15:07Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-13T18:38:36Z"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.4.0

Fixed

4.4.4

Affected versions

v4.*

v4.4.0

v4.4.1

v4.4.2

v4.4.3