GHSA-mg54-p2wj-5ph7MediumCVSS 4.3

moodle: IDOR when fetching report schedules

Published
November 18, 2024
Last Modified
November 20, 2024

🔗 CVE IDs covered (1)

CVE-2024-48901 →

📋 Description

A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.

🎯 Affected products4

  • composer/moodle/moodle:< 4.1.14
  • composer/moodle/moodle:>= 4.2.0, < 4.2.11
  • composer/moodle/moodle:>= 4.3.0, < 4.3.8
  • composer/moodle/moodle:>= 4.4.0, < 4.4.4

🔗 References (3)