Vulnerability in jleyva moodle-block_configurablereports

[ Description ]Official description

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/jleyva/moodle-block_configurablereports/blob/5.2.0/classes/external.php
• github.com/jleyva/moodle-block_configurablereports/commit/4a0e6eadf7bdb6fa52ef71141bdf1…
• github.com/jleyva/moodle-block_configurablereports/releases/tag/5.3.0
• www.vulncheck.com/advisories/configurable-reports-block-for-moodle-before-5.3.0-authori…