PT-2010-3287 · Moodle · Moodle

Published 2010-04-29 · Updated 2022-05-13 · CVE-2010-1617

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.8.x through 1.8.11 Moodle versions 1.9.x through 1.9.7

Description The issue allows remote authenticated users to obtain the full names of other users via the course profile page due to improper role checking in the user/view.php file.

Recommendations For Moodle versions 1.8.x through 1.8.11, update to version 1.8.12 or later. For Moodle versions 1.9.x through 1.9.7, update to version 1.9.8 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-264

CWE-862

Related Identifiers

CVE-2010-1617

DSA-2115-1

GHSA-Q53J-C866-H9MW

Affected Products

Moodle

References · 7

• http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q53j-c866-h9mw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1617 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1617 · Note
• http://vupen.com/english/advisories/2010/1107 · Note
• http://cvs.moodle.org/moodle/user/view.php?r1=1.168.2.28&r2=1.168.2.29 · Note
• http://moodle.org/security · Note