GHSA-93wh-35r4-6qmw
Moodle allowed some users without permission to view other users' full names
At a glance
- Published
- Updated
- CVE
- CVE-2021-20281
- Aliases
- BIT-moodle-2021-20281
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 3.10.0, fixed 3.10.2 |
| Packagist · moodle/moodle | introduced 3.9.0, fixed 3.9.5 |
| Packagist · moodle/moodle | introduced 3.8.0, fixed 3.8.8 |
| Packagist · moodle/moodle | introduced 3.5, fixed 3.5.17 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-20281 ADVISORY
- https://github.com/moodle/moodle/commit/33d6017287e1835513a3de8edd3fbf7a6a90af9c WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1939041 WEB
- https://github.com/moodle/moodle PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT WEB
- https://moodle.org/mod/forum/discuss.php?d=419652 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |