Description
A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | moodle | 4.4.0 – < 4.4.4, 4.3.0 – < 4.3.8, 4.2.0 – < 4.2.11, 4.1.0 – < 4.1.14, < 4.1.0 | 4.4.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | moodle | No fix yet | — |
| Ubuntu Pro 16.04 LTS | moodle | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | < 4.1.14 | 4.1.14 | GHSA-cq5f-wv7p-5gfc |
| Packagist | moodle/moodle | >= 4.2.0, < 4.2.11 | 4.2.11 | GHSA-cq5f-wv7p-5gfc |
| Packagist | moodle/moodle | >= 4.3.0, < 4.3.8 | 4.3.8 | GHSA-cq5f-wv7p-5gfc |
| Packagist | moodle/moodle | >= 4.4.0, < 4.4.4 | 4.4.4 | GHSA-cq5f-wv7p-5gfc |
Advisories 1
- WID-SEC-2024-3177 Moodle: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen und die Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 14, 2024
References
- RHBZ#2318822 issue-tracking