Moodle is vulnerable to feedback activity restriction bypass. The availability dates for feedback are not honored in complete.php
allowing authenticated attackers to access the feedback activity when it shouldn’t be available.
CPE | Name | Operator | Version |
---|---|---|---|
moodle/moodle | le | 2.6.1 | |
moodle/moodle | le | 2.4.8 | |
moodle/moodle | le | 2.5.4 | |
moodle/moodle | le | 2.3.11 |