CVE-2023-5545: Moodle: auto-populated h5p author name causes a potential information leak
Published Oct 12, 2023
·Updated
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
Affected Software
13 affected componentsFixes available
composer/moodle/moodle<4.3.0-rc2
4.3.0-rc2
redhat/moodle<4.2.3
4.2.3
redhat/moodle<4.1.6
4.1.6
redhat/moodle<4.0.11
4.0.11
redhat/moodle<3.11.17
3.11.17
redhat/moodle<3.9.24
3.9.24
Moodle moodle<3.9.24
Moodle moodle>=3.11.0<3.11.17
Moodle moodle>=4.0.0<4.0.11
Moodle moodle>=4.1.0<4.1.6
Moodle moodle>=4.2.0<4.2.3
Fedoraproject Extra Packages For Enterprise Linux=7.0
Fedoraproject Fedora=38
Remediation
Patch Available
Patch Available
Event History
Nov 9, 2023
CVE Published
via MITRE·07:33 PM
Data Sourced
via MITRE·07:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-5545.
2
What is the severity level of CVE-2023-5545?
The severity level of CVE-2023-5545 is medium with a score of 5.3.
3
How does the vulnerability affect Moodle?
The vulnerability affects Moodle versions up to 4.2.3, 4.1.6, 4.0.11, 3.11.17, and 3.9.24.
4
What is the potential impact of this vulnerability?
The vulnerability can cause an information leak by automatically populating the H5P author name with the user's username.
5
How can I fix CVE-2023-5545?
To fix CVE-2023-5545, you need to update Moodle to version 4.2.3, 4.1.6, 4.0.11, 3.11.17, or 3.9.24.