CVE-2012-2353: Moodle Exposes Sensitive User Information
Summary
CVE-2012-2353: Moodle Exposes Sensitive User Information. Affects moodle/moodle across 2 version ranges.
>= 2.1, < 2.1.6
>= 2.2, < 2.2.3
Fixed in 2.1.6 or 2.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a platform for teachers to interact with students, manage course materials, and track student progress. Moodle is widely adopted and offers various features to enhance the learning experience.
Vulnerability Detail
Moodle versions 2.1.x before 2.1.6 and 2.2.x before 2.2.3 suffer from a vulnerability that allows remote authenticated users with the teacher role to access sensitive user information. By navigating to the 'Enrolled users' section under the Users Settings, these users can obtain sensitive data from hidden fields. This vulnerability poses a risk to user privacy and confidentiality, as it allows unauthorized access to personal information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 2.1.62.1.6composer require moodle/moodle:2.1.6 -
>= 2.2, < 2.2.32.2.3composer require moodle/moodle:2.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Moodle.
Conclusion
The vulnerability in Moodle versions 2.1.x and 2.2.x allows remote authenticated users to access sensitive user information. It is crucial for administrators to upgrade to the patched versions to mitigate the risk of unauthorized access to personal data. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used by educational institutions to create and manage online courses.
This vulnerability allows remote authenticated users with the teacher role to access sensitive user information, compromising user privacy and confidentiality.
To fix this vulnerability, upgrade Moodle to version 2.1.6 or later for Moodle 2.1.x installations, and version 2.2.3 or later for Moodle 2.2.x installations.
No, there is no known workaround for this vulnerability. Upgrading to the patched versions is the recommended solution.
You can find more information about this vulnerability in the official Moodle documentation or by referring to the provided sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
