GHSA-4qww-rxq6-x7gfMediumCVSS 6.2

Moodle broken access control when setting calendar event type

Published
May 31, 2024
Last Modified
July 5, 2024

🔗 CVE IDs covered (1)

CVE-2024-33996 →

📋 Description

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

🎯 Affected products3

  • composer/moodle/moodle:>= 4.3.0, < 4.3.4
  • composer/moodle/moodle:>= 4.2.0, < 4.2.7
  • composer/moodle/moodle:< 4.1.10

🔗 References (4)