medium5.3
CVE-2021-20281
Moodle allowed some users without permission to view other users' full names
Impact
It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.10.0, < 3.10.2 | 3.10.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 3.5.0 before 3.5.17 from 3.8.0 before 3.8.8 from 3.9.0 before 3.9.5 from 3.10.0 before 3.10.2 |
| Fedoraproject | Fedora | Versions 32, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1939041
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
- https://moodle.org/mod/forum/discuss.php?d=419652
- https://github.com/advisories/GHSA-93wh-35r4-6qmw
- https://nvd.nist.gov/vuln/detail/CVE-2021-20281
- https://github.com/moodle/moodle/commit/33d6017287e1835513a3de8edd3fbf7a6a90af9c
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/