CVE-2024-25980

low-risk
Published 2024-02-19

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Moodle Fedoraproject

References (8)

Patch http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2264096
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...
Vendor Advisory https://moodle.org/mod/forum/discuss.php?d=455636
Patch http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2264096
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproje...
Vendor Advisory https://moodle.org/mod/forum/discuss.php?d=455636
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low