Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2024-33996

moodle: broken access control when setting calendar event type

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Moodle Moodle

Default version status: unknown

  • 4.0 to ≤ 4.3.3affected
  • 4.2 to ≤ 4.2.6affected
  • 4.1 to ≤ 4.1.9affected

References