CVE-2017-2642: Moodle User fullname disclosure on user preferences page
Summary
CVE-2017-2642: Moodle User fullname disclosure on user preferences page. Affects moodle/moodle across 3 version ranges.
>= 3.1, < 3.1.7
>= 3.2, < 3.2.4
>= 3.3, < 3.3.1
Fixed in 3.1.7, 3.2.4 or 3.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system widely used in educational institutions. It provides a platform for creating and managing online courses, allowing educators to interact with students and facilitate learning. The Moodle package, specifically versions 3.1 to 3.3, is affected by a vulnerability that leads to user fullname disclosure on the user preferences page.
Vulnerability Detail
The vulnerability in Moodle 3.x allows an attacker to access and disclose the full names of users through the user preferences page. This can potentially lead to privacy breaches and expose sensitive information. The issue arises due to a lack of proper access controls and validation mechanisms in the affected versions of Moodle.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1, < 3.1.73.1.7composer require moodle/moodle:3.1.7 -
>= 3.2, < 3.2.43.2.4composer require moodle/moodle:3.2.4 -
>= 3.3, < 3.3.13.3.1composer require moodle/moodle:3.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually modify the code to implement stricter access controls and validation mechanisms. However, it is strongly advised to apply the official patches and upgrade to the latest versions of Moodle to ensure comprehensive security.
Conclusion
The vulnerability in Moodle versions 3.1 to 3.3 allows unauthorized access to user fullnames, potentially compromising privacy and exposing sensitive information. It is crucial to apply the provided patches and upgrade to the latest versions of Moodle to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability allows unauthorized access to user fullnames, potentially leading to privacy breaches and exposure of sensitive information.
Users of Moodle versions 3.1 to 3.3 are affected by this vulnerability.
There are no known exploits for this vulnerability at the moment.
No, this vulnerability requires an authenticated user to exploit it.
Yes, patches have been released to fix this vulnerability. Upgrading to the latest versions of Moodle is recommended.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
