~ / search / GHSA-hh52-g5c4-wprh

GHSA-hh52-g5c4-wprh

Moodle may allow authenticated users to enumerate other user's names via learning plans page

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-28334

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 4.1.0, < 4.1.2 4.1.2
Packagist moodle/moodle >= 4.0.0, < 4.0.7 4.0.7
Packagist moodle/moodle >= 3.11.0, < 3.11.13 3.11.13
Packagist moodle/moodle < 3.9.20 3.9.20

Details

As written in the advisory (Markdown source, shown as plain text).

Authenticated users were able to enumerate other users' names via the learning plans page.

References

External links from the advisory. They lead to third-party sites.