What is GHSA-2m72-m5cw-3g9h?

GHSA-2m72-m5cw-3g9h is a security advisory published by GitHub Security Advisories with Medium severity. Missing permission check in Moodle

Which CVE IDs does GHSA-2m72-m5cw-3g9h cover?

GHSA-2m72-m5cw-3g9h covers the following CVE IDs: CVE-2021-20283. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2m72-m5cw-3g9h?

GHSA-2m72-m5cw-3g9h has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-2m72-m5cw-3g9h?

GHSA-2m72-m5cw-3g9h affects 4 products, including: composer/moodle/moodle:\u003e= 3.10.0, \u003c 3.10.2; composer/moodle/moodle:\u003e= 3.9.0, \u003c 3.9.5; composer/moodle/moodle:\u003e= 3.8.0, \u003c 3.8.8; composer/moodle/moodle:\u003c 3.5.17.

GHSA-2m72-m5cw-3g9hMediumCVSS 4.3

Missing permission check in Moodle

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 23, 2024

🔗 CVE IDs covered (1)

CVE-2021-20283 →

📋 Description

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

🎯 Affected products4

composer/moodle/moodle:>= 3.10.0, < 3.10.2
composer/moodle/moodle:>= 3.9.0, < 3.9.5
composer/moodle/moodle:>= 3.8.0, < 3.8.8
composer/moodle/moodle:< 3.5.17

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2021-20283
https://bugzilla.redhat.com/show_bug.cgi?id=1939051
https://moodle.org/mod/forum/discuss.php?d=419654
https://lists.fedoraproject.org/archives/list/[email protected]/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS
https://lists.fedoraproject.org/archives/list/[email protected]/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT
https://github.com/advisories/GHSA-2m72-m5cw-3g9h