GitHub Advisoryadvisory · Packagist

GHSA-wmvq-q9h8-7j4g Moodle sensitive information disclosure

MEDIUM Published 2022-05-13 Modified 2023-07-21 Official page ↗
Aliases
CVE-2018-10889
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-07-21

Affected packages

• Packagist moodle/moodle: >= 3.5, < 3.5.1 → fixed in 3.5.1 • Packagist moodle/moodle: >= 3.4.3, < 3.4.4 → fixed in 3.4.4 • Packagist moodle/moodle: >= 3.3, < 3.3.7 → fixed in 3.3.7

Description

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.

Related

Alias · CVE (1)

  • CVE-2018-10889 A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References