GitHub Advisory DatabaseGHSA-FM5H-58G2-4M3FMoodle Improper Access Control vulnerability
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.8%
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| moodle/moodle | lt | 4.3.0-rc2 |
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-66730
bugzilla.redhat.com/show_bug.cgi?id=2243451
github.com/advisories/GHSA-fm5h-58g2-4m3f
github.com/moodle/moodle/commit/5a765e124c950b1e4313c9bf96ea2dd194f65c75
moodle.org/mod/forum/discuss.php?d=451590
nvd.nist.gov/vuln/detail/CVE-2023-5549
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.8%