CVE-2024-25980

Msa-24-0003: h5p attempts report did not respect activity group settings

State: Published
Severity: 4.3 Medium
Published: Feb 19, 2024
Updated: Aug 1, 2024
Reserved: Feb 13, 2024

Description

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	fedora

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
moodle	4.3.0 to before 4.3.3Affected 4.2.0 to before 4.2.6Affected before 4.1.9Affected

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
RHBZ#2264096issue-tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB/
https://moodle.org/mod/forum/discuss.php?d=455636

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.