Description

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.

Remediation

References

CVE-2010-1617

Related Vulnerabilities

phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9855)

phpBB Improper Initialization Vulnerability (CVE-2001-1471)

Python Uncontrolled Resource Consumption Vulnerability (CVE-2022-45061)

PostgreSQL Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2021-3393)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-40177)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2010-1617