CVE-2024-25980: 
PHP vulnerability analysis and mitigation

CVE-2024-25980 is a security vulnerability discovered in Moodle's H5P attempts report functionality. The vulnerability was disclosed on February 19, 2024, affecting Moodle versions 4.1.0 through 4.1.8, 4.2.0 through 4.2.5, and 4.3.0 through 4.3.2. The issue involves Separate Groups mode restrictions not being properly honored in the H5P attempts report, which resulted in displaying users from other groups (Moodle Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue stems from improper access control (CWE-284) in the H5P attempts report functionality, where the system failed to properly enforce group-based access restrictions (NVD).

By default, this vulnerability primarily affected non-editing teachers, allowing them to view user information from groups they should not have access to. The security impact is limited to unauthorized information disclosure, with no impact on system integrity or availability (Moodle Advisory).

The vulnerability can be exploited remotely through the H5P attempts report interface. No special privileges or user interaction is required to exploit this vulnerability, though the impact is limited to viewing user information from other groups (NVD).

The vulnerability has been fixed in Moodle versions 4.3.3, 4.2.6, and 4.1.9. Organizations running affected versions should upgrade to the fixed versions to address this security issue (Moodle Advisory).