Description
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
Remediation
References
Related Vulnerabilities
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2023-4006)
WordPress Plugin AdWizz 'link' Parameter Cross-Site Scripting (1.0)
WordPress Plugin WordPress Video Player Cross-Site Scripting (1.5.1)
Zenphoto Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-36079)
Jboss EAP Uncontrolled Resource Consumption Vulnerability (CVE-2016-8610)