GitHub Advisoryadvisory · Packagist

GHSA-c767-4whh-v7rw Moodle has user information visibility control issues in gradebook reports

LOW Published 2024-11-11 Modified 2024-11-12 Official page ↗
Aliases
CVE-2024-43429
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-312
Reviewed
2024-11-12

Affected packages

• Packagist moodle/moodle: >= 4.4.0, < 4.4.2 → fixed in 4.4.2 • Packagist moodle/moodle: >= 4.3.0, < 4.3.6 → fixed in 4.3.6 • Packagist moodle/moodle: >= 4.2.0, < 4.2.9 → fixed in 4.2.9 • Packagist moodle/moodle: < 4.1.12 → fixed in 4.1.12

Description

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Related

Alias · CVE (1)

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References