Lucene search

GitHub Advisory DatabaseGHSA-45RW-4R25-JVG7

HistoryMay 13, 2022 - 1:05 a.m.

Moodle Logged in users could view all calendar events

2022-05-1301:05:22

CWE-863

GitHub Advisory Database

github.com

moodle

calendar

vulnerability

access

software

permissions

event.modalpopup

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

22.7%

JSON

A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar’s edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)

Affected configurations

Vulners

Node

moodlemoodleRange<3.6.3

moodlemoodleRange<3.5.5

moodlemoodleRange<3.4.8

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848

github.com/advisories/GHSA-45rw-4r25-jvg7

moodle.org/mod/forum/discuss.php?d=384011#p1547743

nvd.nist.gov/vuln/detail/CVE-2019-3848

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

22.7%

JSON

Related for GHSA-45RW-4R25-JVG7