CVE-2024-25980: Msa-24-0003: h5p attempts report did not respect activity group settings
MSA-24-0003: H5P attempts report did not respect activity group settings
Description: Separate Groups mode restrictions were not honoured in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. Issue summary: H5P attempts report did not respect activity group settings Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Leon Stringer Issue no.: MDL-80501 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
Other sources
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
redhat/4.2.6 andto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.1.9 - Compensating control
If you cannot upgrade, review Separate Groups mode usage for the H5P attempts report and ensure only appropriate users can access the report (the issue could display users from other groups).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25980?
CVE-2024-25980 is classified as a moderate severity vulnerability.
What does CVE-2024-25980 affect?
CVE-2024-25980 affects Moodle versions before 4.1.9, 4.2.6, and 4.3.3.
How do I fix CVE-2024-25980?
To fix CVE-2024-25980, upgrade your Moodle installation to version 4.1.9, 4.2.6, or 4.3.3.
What are the consequences of CVE-2024-25980?
CVE-2024-25980 can lead to unauthorized access to user attempts from other groups.
Who is affected by CVE-2024-25980?
Non-editing teachers could gain additional access to data due to CVE-2024-25980.