Executive brief
Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page
Affected products
- Packagist moodle/moodle
Junglewise Threat Intelligence
CVE-2011-4284: Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page
CVE-2011-4284 · Severity: medium · CVSS 4 · Published 2022-05-13
Technologies: moodle/moodle (Packagist). Vendors: Packagist.
Related threats
- Moodle course access permissions are not properly checked in course_output_fragment_course_overview
- Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
- Moodle allows unauthenticated REST API user data exposure
- Moodle reveals student identities through assignment submissions search on anonymous submissions
- Moodle IDOR when accessing list of course badges