GitHub Advisoryadvisory · Packagist
GHSA-vpq5-56jj-vf2m Moodle admin presets export tool includes some secrets that should not be exported
LOW
Official page ↗
- Aliases
- CVE-2024-43427
- Ecosystem
- Packagist
- Packages
- moodle/moodle
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-922
- Reviewed
- 2024-11-12
Affected packages
• Packagist moodle/moodle: >= 4.4.0, < 4.4.2 → fixed in 4.4.2
• Packagist moodle/moodle: >= 4.3.0, < 4.3.6 → fixed in 4.3.6
• Packagist moodle/moodle: >= 4.2.0, < 4.2.9 → fixed in 4.2.9
• Packagist moodle/moodle: < 4.1.12 → fixed in 4.1.12
Description
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
Related
Alias · CVE (1)
- CVE-2024-43427 A flaw was found in moodle. vulnerability
Weakness · CWE (1)
- CWE-922 Insecure Storage of Sensitive Information weakness