What is GHSA-mr97-gvvg-rhgh?

GHSA-mr97-gvvg-rhgh is a security advisory published by GitHub Security Advisories with Medium severity. Moodle Exposes Sensitive User Information

Which CVE IDs does GHSA-mr97-gvvg-rhgh cover?

GHSA-mr97-gvvg-rhgh covers the following CVE IDs: CVE-2012-2353. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mr97-gvvg-rhgh?

GHSA-mr97-gvvg-rhgh affects 2 products, including: composer/moodle/moodle:\u003e= 2.1, \u003c 2.1.6; composer/moodle/moodle:\u003e= 2.2, \u003c 2.2.3.

GHSA-mr97-gvvg-rhghMedium

Moodle Exposes Sensitive User Information

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-2353 →

📋 Description

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.

🎯 Affected products2

composer/moodle/moodle:>= 2.1, < 2.1.6
composer/moodle/moodle:>= 2.2, < 2.2.3

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2012-2353
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31923
http://openwall.com/lists/oss-security/2012/05/23/2
https://github.com/moodle/moodle/commit/a645b79113b2ee7881b6bdae64a0c2a9f04db5c7
https://github.com/moodle/moodle/commit/ce13ea6ceb15f00c3cc6d40d79b06be39de7987a
https://github.com/moodle/moodle/commit/cfaa50a61d61719c65aa7e26f5444852931e07b6
https://github.com/advisories/GHSA-mr97-gvvg-rhgh