GoogleOSV:GHSA-HH52-G5C4-WPRHMoodle may allow authenticated users to enumerate other user's names via learning plans page
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
21.0%
Authenticated users were able to enumerate other users’ names via the learning plans page.
References
bugzilla.redhat.com/show_bug.cgi?id=2179423
git.moodle.org/gw?p=moodle.git;a=commit;h=0e3c8eb740e1e49a62a5f452cda7e06258712bbf
github.com/moodle/moodle
github.com/moodle/moodle/commit/0e3c8eb740e1e49a62a5f452cda7e06258712bbf
moodle.org/mod/forum/discuss.php?d=445066
nvd.nist.gov/vuln/detail/CVE-2023-28334
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
21.0%