GitHub Advisoryadvisory · Packagist

GHSA-wmmc-qjq2-vvm2 Moodle is vulnerable to Sensitive Information Disclosure

MEDIUM Published 2022-05-13 Modified 2023-08-17 Official page ↗
Aliases
CVE-2013-2080
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-08-17

Affected packages

• Packagist moodle/moodle: < 2.3.7 → fixed in 2.3.7 • Packagist moodle/moodle: >= 2.4.0, < 2.4.4 → fixed in 2.4.4

Description

The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.

Related

Alias · CVE (1)

  • CVE-2013-2080 The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References