CVE-2024-25980CWE-284

Msa-24-0003: h5p attempts report did not respect activity group settings

Medium · published February 19, 2024

CVSS v3.1
4.3
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00533 · 44.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-02-19T16:32Z
EPSS history
Timeline
  • 19 FEB 16:32Z
    Msa-24-0003: h5p attempts report did not respect activity group settings
    cvelistv5