CVE-2024-25979 Msa-24-0002: forum search accepted random parameters in its url

2024-02-1916:31:34

CWE-233

fedora

github.com

forum search

url parameters

random parameters

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

The URL parameters accepted by forum search were not limited to the allowed parameters.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "moodle",
    "versions": [
      {
        "status": "affected",
        "version": "4.3.0",
        "lessThan": "4.3.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.2.0",
        "lessThan": "4.2.6",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.1.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]