moodle
At a glance
- Source
- NVD
- EPSS
- EPSS 0.74 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-vrpr-2xxx-g444 — Moodle Exposure of Sensitive Information to an Unauthorized Actor
European references
- ENISA EUVD · EUVD-2022-1554
- GCVE · GCVE-0-2021-32477
CERT-FR advisories
- CERTFR-2021-AVI-386 — Multiples vulnérabilités dans Moodle · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 3.10.0 < 3.10.4
Affected products
| Product | Versions |
|---|---|
| moodle | affected 3.10 to 3.10.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |