PT-2017-12372 · Moodle · Moodle

Juan Leyva · Published 2017-09-18 · Updated 2022-05-17 · CVE-2017-12157

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description The issue allows teachers to view details about users in groups they cannot access through various course reports.

Recommendations For Moodle versions 3.x, update to a version where this issue is resolved, or consider restricting access to sensitive course reports until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-12157

GHSA-GW95-48XQ-GQF9

Affected Products

Moodle

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2017-12157 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12157 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gw95-48xq-gqf9 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=358586 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12157 · Security Note
• https://ubuntu.com/security/CVE-2017-12157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12157 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/85b531e8beae3497ec2075e07e59c581fccb317c · Note
• https://web.archive.org/web/20210124103841/http://securityfocus.com/bid/100848 · Note
• http://securityfocus.com/bid/100848 · Note