MEDIUM5.3

GHSA-fm5h-58g2-4m3f

Moodle Improper Access Control vulnerability

Quick fix

GHSA-fm5h-58g2-4m3f — moodle/moodle: upgrade to the fixed version with the command below.

composer require moodle/moodle:^4.3.0-rc2

Details

Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/moodle/moodle

Introduced in: 0Fixed in: 4.3.0-rc2

Fixcomposer require moodle/moodle:^4.3.0-rc2

References

https://nvd.nist.gov/vuln/detail/CVE-2023-5549[ADVISORY]
https://github.com/moodle/moodle/commit/5a765e124c950b1e4313c9bf96ea2dd194f65c75[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=2243451[WEB]
https://github.com/moodle/moodle[PACKAGE]
https://moodle.org/mod/forum/discuss.php?d=451590[WEB]
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-66730[WEB]