Description
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events.
Remediation
References
Related Vulnerabilities
WordPress Plugin Fitness Trainer-Training Membership Cross-Site Scripting (1.0.8)
MySQL CVE-2017-10378 Vulnerability (CVE-2017-10378)
WordPress Plugin NextScripts:Social Networks Auto-Poster Cross-Site Scripting (3.4.17)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4295)
WordPress Plugin WordPress renaming tool by Vlajo Arbitrary File Download (1.0)