CVE-2024-25980: Improper Access Control in moodle
Improper Access Control in moodle
Other sources
MSA-24-0003: H5P attempts report did not respect activity group settings
Description: Separate Groups mode restrictions were not honoured in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers. Issue summary: H5P attempts report did not respect activity group settings Severity/Risk: Minor Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier unsupported versions Versions fixed: 4.3.3, 4.2.6 and 4.1.9 Reported by: Leon Stringer Issue no.: MDL-80501 CVE identifier: Pending Changes (master): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
— Red Hat
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
redhat/4.2.6 andto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.3.3 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
moodleto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25980?
CVE-2024-25980 is classified as a moderate severity vulnerability.
What does CVE-2024-25980 affect?
CVE-2024-25980 affects Moodle versions before 4.1.9, 4.2.6, and 4.3.3.
How do I fix CVE-2024-25980?
To fix CVE-2024-25980, upgrade your Moodle installation to version 4.1.9, 4.2.6, or 4.3.3.
What are the consequences of CVE-2024-25980?
CVE-2024-25980 can lead to unauthorized access to user attempts from other groups.
Who is affected by CVE-2024-25980?
Non-editing teachers could gain additional access to data due to CVE-2024-25980.