~ / search / GHSA-c7v4-m269-4995

GHSA-c7v4-m269-4995

Exposure of Sensitive Information to an Unauthorized Actor in Moodle

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-25703

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.9.0, < 3.9.3 3.9.3
Packagist moodle/moodle >= 3.8.0, < 3.8.6 3.8.6
Packagist moodle/moodle >= 3.7.0, < 3.7.9 3.7.9
Packagist moodle/moodle >= 3.10.0-beta, < 3.10.0 3.10.0

Details

As written in the advisory (Markdown source, shown as plain text).

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.

References

External links from the advisory. They lead to third-party sites.