medium4.0
CVE-2010-1617
Moodle doesn't properly check role
Impact
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 1.8.0, < 1.8.12 | 1.8.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | Versions 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://cvs.moodle.org/moodle/user/view.php?r1=1.168.2.28&r2=1.168.2.29
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://moodle.org/security/
- http://www.vupen.com/english/advisories/2010/1107
- https://github.com/advisories/GHSA-q53j-c866-h9mw
- https://nvd.nist.gov/vuln/detail/CVE-2010-1617
- http://moodle.org/security