CVE-2024-48900

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-489014.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have pe CVE-2024-489025.4In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP CVE-2024-489037.8An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affect CVE-2024-489049.8An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.CVE-2024-489059.1Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.CVE-2024-489066.1Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.CVE-2024-489077.5Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.CVE-2024-489086.9lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack CVE-2024-489092.4SpiceDB is an open source database for scalably storing and querying fine-grained authorization data. Starting in version 1.35.0 and prior t CVE-2024-48915.4The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2024-489109.8DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. CVE-2024-489117.8OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the conf