Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-4c5g-w3gf-rf4f
Advisory ID github_osv/GHSA-4c5g-w3gf-rf4f
Aliases CVE-2014-3546
Summary Moodle allows attackers to obtain username and course information Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-45760
http://openwall.com/lists/oss-security/2014/07/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/2ca9e09dab3ff374e1026780b23c63751f4ee312
https://github.com/moodle/moodle/commit/74556525de9617c593c3e08269d6d541c6576c90
https://github.com/moodle/moodle/commit/8f7d596058a18c60b795b4677b59cf074c56de39
https://github.com/moodle/moodle/commit/9dbf62d23017a91fcbf63bba7f2eb4835f77b8c9
https://github.com/moodle/moodle/commit/dc97145785b9ae192168659c65309bca61a58151
https://moodle.org/mod/forum/discuss.php?d=264267
CVE-2014-3546 https://nvd.nist.gov/vuln/detail/CVE-2014-3546
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.