GHSA-q53j-c866-h9mw
Moodle doesn't properly check role
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 1.8.0, < 1.8.12 | 1.8.12 |
| Packagist | moodle/moodle | >= 1.9.0, < 1.9.8 | 1.9.8 |
Details
As written in the advisory (Markdown source, shown as plain text).
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.
References
External links from the advisory. They lead to third-party sites.