GitHub Advisoryadvisory · Packagist

GHSA-93wh-35r4-6qmw Moodle allowed some users without permission to view other users' full names

MEDIUM Published 2021-03-29 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-20281
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-863
Reviewed
2021-03-24

Affected packages

• Packagist moodle/moodle: >= 3.10.0, < 3.10.2 → fixed in 3.10.2 • Packagist moodle/moodle: >= 3.9.0, < 3.9.5 → fixed in 3.9.5 • Packagist moodle/moodle: >= 3.8.0, < 3.8.8 → fixed in 3.8.8 • Packagist moodle/moodle: >= 3.5, < 3.5.17 → fixed in 3.5.17

Description

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Related

Alias · CVE (1)

  • CVE-2021-20281 It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-863 Incorrect Authorization weakness

References