CVE-2023-5545 Moodle: auto-populated h5p author name causes a potential information leak

2023-11-0919:33:18

CWE-200

fedora

github.com

cve-2023-5545

moodle

information leak

h5p

metadata

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

H5P metadata automatically populated the author with the user’s username, which could be sensitive information.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:moodle:h5p:4.1:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "h5p",
    "versions": [
      {
        "status": "affected",
        "version": "4.1"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:moodle:h5p:4.2:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "h5p",
    "versions": [
      {
        "status": "affected",
        "version": "4.2"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:moodle:h5p:4.0:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "h5p",
    "versions": [
      {
        "status": "affected",
        "version": "4.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:moodle:h5p:3.11:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "h5p",
    "versions": [
      {
        "status": "affected",
        "version": "3.11"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:moodle:h5p:3.9:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "h5p",
    "versions": [
      {
        "status": "affected",
        "version": "3.9"
      }
    ],
    "defaultStatus": "unknown"
  }
]