Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2021-20281

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

VectorNETWORK

PublishedMar 15, 2021, 22:15

Published Bysecalert@redhat.com

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)3.10.03.10.2N/A

moodle/moodle(Packagist)3.9.03.9.5N/A

moodle/moodle(Packagist)3.8.03.8.8N/A

moodle/moodle(Packagist)3.53.5.17N/A

References

https://bugzilla.redhat.com/show_bug.cgi?id=1939041
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT/
https://moodle.org/mod/forum/discuss.php?d=419652

Weakness Type

CWE-863

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK