CVE-2012-2353

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.

Score

CVSS 2.0 4.0 Medium

Status

Modified - secalert@redhat.com

Published

2012-07-21

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Moodle (Moodle)

References

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31923
• http://openwall.com/lists/oss-security/2012/05/23/2