GHSA-c3vx-v4x8-x894Medium

Moodle does not check for the moodle/course:viewhiddencourses capability

Published
May 13, 2022
Last Modified
January 24, 2024

🔗 CVE IDs covered (1)

CVE-2014-0217 →

📋 Description

enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.

🎯 Affected products1

  • composer/moodle/moodle:>= 2.6.0, < 2.6.3

🔗 References (7)