Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient access control checks in the process of fetching course badges. Remediation Upgrade moodle/moodle to version 4.4.4 or higher. References - GitHub Commit -...

CVE-2024-48899

CVE-2024-48899 affects Moodle with an insecure direct object reference (IDOR) when accessing the list of course badges. The root cause is insufficient access checks that allow unauthorized retrieval of badge-related data across courses. Affected information: course badge lists (and potentially ba...

CVE-2024-48899 Moodle: idor when accessing list of course badges

A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...

CVE-2024-48899 Moodle: idor when accessing list of course badges

A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...

CVE-2024-48899 Moodle: idor when accessing list of course badges

A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the need to perform additional checks to ensure that users only ha...

PT-2024-33258 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A vulnerability was found in Moodle, where additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a relatively laxity in the password checking logic, where certain...

CVE-2024-52585

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing...

CVE-2024-52585 Autolab has HTML Injection Vulnerability

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing...

CVE-2024-52585

Autolab CVE-2024-52585 affects Autolab 3.0.1 with an HTML injection vulnerability on the grade submissions page that can impact instructors and CAs. The issue is mitigated by upgrading to 3.0.2 or applying the patch manually: edit line 589 in gradesheet.js.erb to take in feedback as text rather t...

CVE-2024-52584 Autolab has vulnerable submission endpoints

Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs hav...

CVE-2024-52584

CVE-2024-52584 – Autolab : Affected software is Autolab (course management service). In version 3.0.1, the authorization check for grade-submission endpoints is scoped to the CA’s class, not the specific submission’s class, allowing CAs to view or edit grades for any submission ID regardless of t...

PT-2024-35382 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.1 Description: The issue concerns an HTML injection vulnerability that can affect instructors and CAs on the grade submissions page. This vulnerability is patched in version 3.0.2. Recommendations: For Autolab version 3.0....

Autolab 跨站脚本漏洞

Autolab is an open source course management service from Autolab. It supports automatically graded programming assignments. A cross-site scripting vulnerability exists in Autolab version 3.0.1, which stems from the presence of an HTML injection vulnerability that could affect instructors and CAs ...

CVE-2024-51658

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658 WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658 WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658

CVE-2024-51658 describes a Cross-Site Request Forgery (CSRF) that enables Stored XSS in the WordPress plugin WP Course Manager for versions up to 1.3. The vulnerability impact is described as stored XSS via CSRF, affecting the WP Course Manager plugin in the listed range. The provided documents d...

WordPress plugin WP Course Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...