PT-2024-21255 · Moodle+1 · Moodle+1

Leon Stringer · Published 2024-02-19 · Updated 2024-06-19 · CVE-2024-25980

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description The issue concerns the H5P attempts report in Separate Groups mode, where restrictions were not properly enforced, allowing the display of users from other groups. By default, this provided additional access to non-editing teachers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2024-8851

ALT-PU-2024-9067

BIT-MOODLE-2024-25980

CVE-2024-25980

GHSA-CP8M-H777-G4P3

Affected Products

Alt Linux

Moodle

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-25980 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-25980 · Security Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-25980 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cp8m-h777-g4p3 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=455636 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KXGBYJ43BUEBUAQZU3DT5I5A3YLF47CB · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25980 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2024-25980 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-25980 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/662192fcecdefdaae79f55db96bd64dbcdeef85b · Note
• https://t.me/cvenotify/72639 · Telegram Post
• https://twitter.com/CVEnew/status/1759619030132863391 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2264096 · Note