Description
lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.
Remediation
References
Related Vulnerabilities
MediaWiki Other Vulnerability (CVE-2013-2114)
WordPress Plugin Fileviewer Cross-Site Request Forgery (2.2)
Squid Improper Certificate Validation Vulnerability (CVE-2023-46724)
Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4522)
WordPress Plugin WP Social Invitations Cross-Site Scripting (1.4.4.2)