Skip to main content

Missing Authorization

CVE-2024-45689

Medium
5.3/10

Summary

A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access. This issue affects moodle/moodle versions prior to 4.1.13, 4.2.x prior to 4.2.10, 4.3.x prior to 4.3.7, and 4.4.x prior to 4.4.3.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-862 - Missing Authorization

The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.

References

Advisory Timeline

  • Published