CVE-2022-40316 - The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to

Back Back to CVE browser

MEDIUM

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to

Published Sep 30, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.66%

Description

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

Affected products

Vendor n/a Product Moodle Default
n/a
- Version
  4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Moodle

n/a

Version	Status	Constraints
4.0 to 4.0.3, 3.11 to 3.11.9, 3.9 to 3.9.16 and earlier unsupported versions	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-668

CWE-862

Missing Authorization

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=2128151
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/advisories/GHSA-385f-vgq7-8hhx
Advisory
https://moodle.org/mod/forum/discuss.php?d=438395
x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40316

Link	Providers	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2128151		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://github.com/advisories/GHSA-385f-vgq7-8hhx		Advisory
https://moodle.org/mod/forum/discuss.php?d=438395		x_refsource_MISCPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40316