Moodle is vulnerable to information disclosure. The vulnerability exists because the forceloginforprofiles
setting is not properly enforced, allowing guest users to view anyone’s profile without permission.
CPE | Name | Operator | Version |
---|---|---|---|
moodle/moodle | le | 2.3.4 | |
moodle/moodle | le | 2.2.7 | |
moodle/moodle | le | 2.1.10 | |
moodle/moodle | le | 2.4.1 |
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481
lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html
lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html
openwall.com/lists/oss-security/2013/03/25/2
git.moodle.org/gw?p=moodle.git;a=commit;h=3ecc63e9dbe29c6a5a8f65fa8e7980ba0fffb5a8
moodle.org/mod/forum/discuss.php?d=225341