CVE-2024-33996

2024-05-3120:15:09

CWE-20

[email protected]

web.nvd.nist.gov

validation

event types

calendar web service

permission

publish

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

References

moodle.org/mod/forum/discuss.php?d=458384#p1840909