Description

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

Remediation

References

CVE-2024-48896

Related Vulnerabilities

Oracle JRE CVE-2013-1561 Vulnerability (CVE-2013-1561)

PHP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-5658)

WordPress Plugin Eyes Only:User Access Shortcode Cross-Site Scripting (1.8.2)

MySQL CVE-2020-14814 Vulnerability (CVE-2020-14814)

WordPress Plugin WordPress Popups for Marketing and Email Newsletters, Lead Generation and Conversions by OptinMonster Cross-Site Scripting (2.6.0)

Severity

Medium

Classification

CVE-2024-48896 CWE-209 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities