CVE-2023-1402: Moodle: course participation report shows roles the user should not see
Published Mar 17, 2023
·Updated
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Affected Software
16 affected componentsFixes available
redhat/moodle<4.1.2
4.1.2
redhat/moodle<4.0.7
4.0.7
redhat/moodle<3.11.13
3.11.13
redhat/moodle<3.9.20
3.9.20
composer/moodle/moodle<3.9.20
3.9.20
composer/moodle/moodle>=3.11.0<3.11.13
3.11.13
composer/moodle/moodle>=4.0.0<4.0.7
4.0.7
composer/moodle/moodle>=4.1.0<4.1.2
4.1.2
Moodle moodle>3.9.0<3.9.20
Moodle moodle>3.11.0<3.11.13
Moodle moodle>4.0.0<4.0.7
Moodle moodle=3.9.0
Moodle moodle=3.11.0
Moodle moodle=4.0.0
Moodle moodle=4.1.0
Moodle moodle=4.1.1
Remediation
Patch Available
Event History
Mar 17, 2023
Data Sourced
via Red Hat·06:05 PM
DescriptionSeverityAffected Software
Mar 23, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the vulnerability CVE-2023-1402?
CVE-2023-1402 is a vulnerability in Moodle that allows unauthorized roles to be displayed in the course participation report.
2
How does CVE-2023-1402 impact Moodle?
CVE-2023-1402 impacts Moodle by exposing roles that users do not have access to view in the course participation report.
3
What is the severity of CVE-2023-1402?
CVE-2023-1402 has a severity rating of medium (4.3).
4
Which versions of Moodle are affected by CVE-2023-1402?
CVE-2023-1402 affects Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1.
5
Is there a fix available for CVE-2023-1402?
Yes, upgrading Moodle to a version beyond the affected range (3.9.21 or higher, 3.11.14 or higher, 4.0.8 or higher, 4.1.2 or higher) resolves the vulnerability.