GHSA-rjh8-w8jg-xwq5

ghsaUSosv

Moodle Exposure of Sensitive Information to an Unauthorized Actor

view advisory published 2022-05-17Licence: CC-BY-4.0

In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-15110US	medium4.3	1.16% (67th)	—	2017-11-20
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all parti…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/101909WEB
https://github.com/moodle/moodlePACKAGE
https://moodle.org/mod/forum/discuss.php?d=361784WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-15110ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan