CVE-2023-5549: Moodle Improper Access Control vulnerability
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Other sources
Moodle Improper Access Control vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.0-rc2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.2.3 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.1.6 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.11 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.17 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.24
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-5549.
What is the severity rating of CVE-2023-5549?
CVE-2023-5549 has a severity rating of 5.3 (medium).
How does CVE-2023-5549 affect Moodle?
CVE-2023-5549 affects Moodle versions 3.9.24 to 4.2.3.
What is the impact of CVE-2023-5549?
The impact of CVE-2023-5549 is the ability for users to move categories they have permission to manage to a parent category they do not have permission to manage.
Are there any remedies or fixes available for CVE-2023-5549?
Yes, there are fixes available for CVE-2023-5549. The affected versions should be updated to 4.3.0-rc2 for Composer installations and to the latest patch versions for Red Hat and Fedora installations.