Описание
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Ссылки
- Issue TrackingThird Party Advisory
- PatchVendor Advisory
- Issue TrackingThird Party Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.7.0 (включая) до 3.7.8 (включая)Версия от 3.8.0 (включая) до 3.8.5 (включая)Версия от 3.9.0 (включая) до 3.9.2 (включая)
Одно из
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Конфигурация 2
Одно из
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
EPSS
Процентиль: 54%
0.00313
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-201
CWE-200
Связанные уязвимости
CVSS3: 5.3
ubuntu
больше 4 лет назад
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
CVSS3: 5.3
debian
больше 4 лет назад
The participants table download in Moodle always included user emails, ...
CVSS3: 5.3
github
больше 3 лет назад
Exposure of Sensitive Information to an Unauthorized Actor in Moodle
EPSS
Процентиль: 54%
0.00313
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-201
CWE-200