by Michael Hawkins.

Additional checks were required to ensure users with the capability to delete comments can only do so in the contexts where they have the permission.

Severity/Risk: Serious

Versions affected: 5.2, 5.1 to 5.1.3, 5.0 to 5.0.6, 4.5 to 4.5.10 and earlier unsupported versions

Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12

Reported by: Paul Holden

CVE identifier: Pending (this will be updated once available)

Changes (main): http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88619

Tracker issue: MDL-88619 IDOR allows arbitrary comment deletion