Vulnerability Bulletins |
MSA-25-0040: Capabilities and callback that control access to profiles not working in some web services |
|
| Affected software | PHP |
|
by Michael Hawkins. Insufficient capability checks meant a callback designed to allow plugins to control user profile access did not correctly limit access in some web service functions.Severity/Risk:MinorVersions affected:5.0 to 5.0.1, 4.5 to 4.5.5, 4.4 to 4.4.9, 4.1 to 4.1.19 and earlier unsupported versionsVersions fixed:5.0.2, 4.5.6, 4.4.10 and 4.1.20Reported by:Albert GassetCVE identifier:Pending (will be added once available)Changes More info: https://moodle.org/mod/forum/discuss.php?d=469493&parent=1884762 |
|