Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-48900
CVE-2024-48900:
PHP vulnerability analysis and mitigation
Overview
A vulnerability was identified in Moodle related to insufficient access control for badge recipients lists. The vulnerability, tracked as CVE-2024-48900, was discovered and disclosed in October 2024. The issue affects Moodle's badge system where users with permission to view badge recipients could potentially access lists beyond their intended access scope (NVD, CVE).
Technical details
The vulnerability is classified as an Insecure Direct Object Reference (IDOR) issue and has been assigned CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating that the vulnerability requires low attack complexity and low privileges to exploit (NVD).
Impact
The vulnerability could allow authenticated users with badge recipient viewing permissions to access badge recipient lists that they should not have access to, potentially exposing sensitive user information beyond the intended scope (Red Hat Bugzilla).
Mitigation and workarounds
Additional security checks have been implemented to ensure users with permission to view badge recipients can only access lists they are intended to have access to. System administrators should apply the appropriate updates when available (CVE).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management