CVE-2024-1439: Inadequate access control vulnerability in Moodle
First published: Mon Feb 12 2024(Updated: )
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.
Credit: cve-coordination@incibe.es cve-coordination@incibe.es
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | <=4.2.0 | |
| Moodle Moodle | <=4.2.11 |
Remedy
There is no reported solution at this time.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/title
- agent/weakness
- agent/remedy
- agent/first-publish-date
- agent/type
- agent/description
- collector/nvd-cve
- source/NVD
- agent/references
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5p2x-8427-9fgp
- alias/CVE-2024-1439
- agent/software-canonical-lookup
- agent/event
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/trending
- package-manager/composer
- vendor/moodle
- canonical/moodle moodle
- version/moodle moodle/4.2.11