REDHAT-BUG-2043414: Medium severity moodle vulnerability
Published Jan 21, 2022
·Updated
Insufficient capability checks made it possible for teachers to download users outside of their courses.
References: https://moodle.org/mod/forum/discuss.php?d=427104
Affected Software
1 affected component
Moodle moodle
Event History
Jan 21, 2022
Data Sourced
via Red Hat·08:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who could exploit this issue?
Teachers could exploit it, because the missing capability checks allowed them to download users who were not enrolled in their courses.
2
What access is required for exploitation?
An attacker would need teacher-level access in Moodle. The available information does not indicate that unauthenticated users could exploit the issue.