{"id":"CVE-2024-48900","aliases":["BIT-moodle-2024-48900","EUVD-2024-3252","GHSA-g8r3-2v89-j6r5"],"status":"published","title":"Moodle: idor when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0035,"percentile":0.28963,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-11-13T14:27:07Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["4.4.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"moodle","fixed_in":["4.4.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"moodle","ranges":[{"type":"SEMVER","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0"},{"fixed":"4.4.4"}]}],"versions":["v4.4.0","v4.4.1","v4.4.2","v4.4.3"]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318818","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48900","tags":["web","advisory"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=462879","tags":["web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-83178","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g8r3-2v89-j6r5"},{"url":"https://moodle.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48900.json","tags":["advisory"]},{"url":"https://github.com/moodle/moodle","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-48900","title":"Moodle: idor when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T14:27:07.416Z","modified":"2024-11-21T18:06:59.546Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:11.638716Z"}],"euvd":[{"id":"EUVD-2024-3252","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T14:27:07Z","modified":"2024-11-21T18:06:59Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:52.521149Z"}],"ghsa":[{"id":"GHSA-g8r3-2v89-j6r5","title":"Moodle IDOR when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T15:31:37Z","modified":"2024-11-13T18:38:38Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:17.357217Z"}],"nvd":[{"id":"CVE-2024-48900","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T15:15:07.577Z","modified":"2026-06-17T07:58:59.957Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:36.931115Z"}],"osv":[{"id":"CVE-2024-48900","title":"Moodle: idor when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T14:27:07.416Z","modified":"2026-10-28T02:30:46.775096015Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:43.597758Z"},{"id":"GHSA-g8r3-2v89-j6r5","title":"Moodle IDOR when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2024-11-13T15:31:37Z","modified":"2025-06-13T06:59:07.279824Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"BIT-moodle-2024-48900","title":"Moodle: idor when accessing list of badge recipients","description":"A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.","status":"published","published":"2025-06-13T06:12:34.451Z","modified":"2026-09-08T08:48:15.568068329Z","updated_at":"2026-11-02T15:28:33.469426Z"}]}}