CVE-2023-5549: Moodle: insufficient capability checks when updating the parent of a course category
Published Oct 12, 2023
·Updated
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Affected Software
13 affected componentsFixes available
composer/moodle/moodle<4.3.0-rc2
4.3.0-rc2
redhat/moodle<4.2.3
4.2.3
redhat/moodle<4.1.6
4.1.6
redhat/moodle<4.0.11
4.0.11
redhat/moodle<3.11.17
3.11.17
redhat/moodle<3.9.24
3.9.24
Moodle moodle<3.9.24
Moodle moodle>=3.11.0<3.11.17
Moodle moodle>=4.0.0<4.0.11
Moodle moodle>=4.1.0<4.1.6
Moodle moodle>=4.2.0<4.2.3
Fedoraproject Extra Packages For Enterprise Linux=7.0
Fedoraproject Fedora=38
Remediation
Patch Available
Patch Available
Event History
Nov 9, 2023
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
09:30 PM
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-5549.
2
What is the severity rating of CVE-2023-5549?
CVE-2023-5549 has a severity rating of 5.3 (medium).
3
How does CVE-2023-5549 affect Moodle?
CVE-2023-5549 affects Moodle versions 3.9.24 to 4.2.3.
4
What is the impact of CVE-2023-5549?
The impact of CVE-2023-5549 is the ability for users to move categories they have permission to manage to a parent category they do not have permission to manage.
5
Are there any remedies or fixes available for CVE-2023-5549?
Yes, there are fixes available for CVE-2023-5549. The affected versions should be updated to 4.3.0-rc2 for Composer installations and to the latest patch versions for Red Hat and Fedora installations.