Description

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Remediation

References

CVE-2021-20281

Related Vulnerabilities

WordPress Plugin CiviCRM Multiple Cross-Site Scripting Vulnerabilities (5.35.0)

MySQL CVE-2016-5625 Vulnerability (CVE-2016-5625)

Django Incorrect Regular Expression Vulnerability (CVE-2018-7537)

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-1582)

WordPress Plugin Link Library 'searchll' Parameter SQL Injection (5.2.1)

Severity

Medium

Classification

CVE-2021-20281 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities