medium4.3
CVE-2023-28334
Moodle may allow authenticated users to enumerate other user's names via learning plans page
Impact
Authenticated users were able to enumerate other users' names via the learning plans page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 4.1.0, < 4.1.2 | 4.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | after 4.0.0 before 4.0.7 Versions 4.0.0, 4.1.0, 4.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2179423
- https://moodle.org/mod/forum/discuss.php?d=445066
- https://github.com/advisories/GHSA-hh52-g5c4-wprh
- https://nvd.nist.gov/vuln/detail/CVE-2023-28334
- https://github.com/moodle/moodle/commit/0e3c8eb740e1e49a62a5f452cda7e06258712bbf
- https://git.moodle.org/gw?p=moodle.git;a=commit;h=0e3c8eb740e1e49a62a5f452cda7e06258712bbf