CVE-2024-48898

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488994.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses tha CVE-2024-48904.9A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerabi CVE-2024-489004.3A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access CVE-2024-489014.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have pe CVE-2024-489025.4In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP CVE-2024-489037.8An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affect CVE-2024-489049.8An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.CVE-2024-489059.1Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.CVE-2024-489066.1Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.CVE-2024-489077.5Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.CVE-2024-489086.9lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack CVE-2024-489092.4SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior t