CVE-2023-1402: Moodle may display roles to users who don't have access to them
Moodle may display roles to users who don't have access to them
Other sources
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.20 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.7 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.13 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.20
Event History
Frequently Asked Questions
What is the vulnerability CVE-2023-1402?
CVE-2023-1402 is a vulnerability in Moodle that allows unauthorized roles to be displayed in the course participation report.
How does CVE-2023-1402 impact Moodle?
CVE-2023-1402 impacts Moodle by exposing roles that users do not have access to view in the course participation report.
What is the severity of CVE-2023-1402?
CVE-2023-1402 has a severity rating of medium (4.3).
Which versions of Moodle are affected by CVE-2023-1402?
CVE-2023-1402 affects Moodle versions 3.9.0 to 3.9.20, 3.11.0 to 3.11.13, 4.0.0 to 4.0.7, 4.1.0, and 4.1.1.
Is there a fix available for CVE-2023-1402?
Yes, upgrading Moodle to a version beyond the affected range (3.9.21 or higher, 3.11.14 or higher, 4.0.8 or higher, 4.1.2 or higher) resolves the vulnerability.