CVE-2024-25980 Msa-24-0003: h5p attempts report did not respect activity group settings

Medium 4.3 Published 19 Feb 2024 Updated 1 Aug 2024

Attackers can view H5P attempt data from other groups, bypassing Separate Groups restrictions and exposing student information.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-25980?

CVE-2024-25980 is a medium-severity missing authorization vulnerability in Fedoraproject Fedora, published on 19 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

Weakness: CWE-284

Which versions are affected by CVE-2024-25980?

7 open source packages ship an affected version, including moodle/moodle and moodle. It affects 2 products.

Package	Affected	Fixed in
`moodle/moodle` Packagist	All versions	`4.1.9`
`moodle/moodle` Packagist	All versions	`4.1.9`
`moodle/moodle` Packagist	From `4.2.0`	`4.2.6`
`moodle/moodle` Packagist	From `4.2.0`	`4.2.6`
`moodle/moodle` Packagist	From `4.3.0`	`4.3.3`
`moodle/moodle` Packagist	From `4.3.0`	`4.3.3`

1 more packages

moodle Bitnami All versions 4.1.9, 4.2.6, 4.3.3

Products include Fedoraproject Fedora, Moodle Moodle.

How do I fix CVE-2024-25980?

Upgrade moodle/moodle to a fixed version for your release line: 4.1.9, 4.2.6 or 4.3.3.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-25980 being exploited?

There is no known exploitation of CVE-2024-25980 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as BIT-moodle-2024-25980, GHSA-cp8m-h777-g4p3, UBUNTU-CVE-2024-25980.