Improper privilege management in Moodle - CVE-2024-55646
Published: December 17, 2024
Vulnerability identifier: #VU101809
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-55646
CWE-ID: CWE-269
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper privilege management. In a database activity with separate groups mode enabled, users who were not in a group (and did not have permission to access all groups) could see entries from members of all groups in the activity, rather than just entries of users also not in any groups.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2024-55646
Install updates from vendor's website.
Moodle - addressed in versions 4.1.15, 4.3.9, 4.4.5, 4.5.1
moodle - addressed in versions 4.3.9-1.fc40, 4.4.5-1.fc41
moodle - addressed in versions 4.3.9-1.fc40, 4.4.5-1.fc41