VulnerabilityModified

CVE-2024-1439

This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles.

LOW 3.3EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent.

CVSS 3.1: 3.3 LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: moodle/moodle
Source: cve-coordination@incibe.es

References

https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-vulnerability-moodleThird Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/inadequate-access-control-vulnerability-moodleThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.