GitHub Advisoryadvisory · Packagist

GHSA-mr97-gvvg-rhgh Moodle Exposes Sensitive User Information

MEDIUM Published 2022-05-13 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-2353
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-01-12

Affected packages

• Packagist moodle/moodle: >= 2.1, < 2.1.6 → fixed in 2.1.6 • Packagist moodle/moodle: >= 2.2, < 2.2.3 → fixed in 2.2.3

Description

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.

Related

Alias · CVE (1)

  • CVE-2012-2353 Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References