GitHub Advisoryadvisory · Packagist

GHSA-phqj-xp48-7p7c Moodle does not use the forceloginforprofiles setting for course-profiles access control

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2011-4279
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-200, CWE-284
Reviewed
2025-04-12

Affected packages

• Packagist moodle/moodle: >= 2.0.0, < 2.0.2 → fixed in 2.0.2

Description

Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google, Yahoo!, Wrensoft Zoom, MSN, Yandex, and AltaVista.

Related

Alias · CVE (1)

  • CVE-2011-4279 Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-284 Improper Access Control weakness

References