What is GHSA-93pj-4p65-qmr9?

GHSA-93pj-4p65-qmr9 is a security advisory published by GitHub Security Advisories with Medium severity. Insufficient user authorization in Moodle

Which CVE IDs does GHSA-93pj-4p65-qmr9 cover?

GHSA-93pj-4p65-qmr9 covers the following CVE IDs: CVE-2022-0334. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-93pj-4p65-qmr9?

GHSA-93pj-4p65-qmr9 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-93pj-4p65-qmr9?

GHSA-93pj-4p65-qmr9 affects 3 products, including: composer/moodle/moodle:\u003e= 3.11, \u003c 3.11.5; composer/moodle/moodle:\u003e= 3.10, \u003c 3.10.8; composer/moodle/moodle:\u003c 3.9.11.

GHSA-93pj-4p65-qmr9MediumCVSS 4.3

Insufficient user authorization in Moodle

Vendor

GitHub Security Advisories

Published

January 28, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-0334 →

📋 Description

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.

🎯 Affected products3

composer/moodle/moodle:>= 3.11, < 3.11.5
composer/moodle/moodle:>= 3.10, < 3.10.8
composer/moodle/moodle:< 3.9.11

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-0334
https://bugzilla.redhat.com/show_bug.cgi?id=2043664
https://moodle.org/mod/forum/discuss.php?d=431102
https://github.com/moodle/moodle/commit/1964d68f8500ea3c7b776fa8a2af6266ed109f84
https://github.com/moodle/moodle/commit/6d18f136ae88ec97e351a723df570816a959ec68
https://github.com/advisories/GHSA-93pj-4p65-qmr9