Moodle missing access checks on H5P content files expose restricted materials
Hidden course materials on the Moodle learning site can be viewed without logging in.
Summary
Moodle's online learning platform lacks proper access checks on H5P content files. An unauthenticated remote attacker can view restricted materials, including files from hidden or unavailable course modules.
What to do
Check that your installed Moodle is newer than the fix bound for its branch (4.5.15, 5.0.11, 5.1.8, 5.2.4), and read Moodle's official advisory before updating.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen