Moodle lacks access restrictions for download assignments. A flaw in mod/assign/locallib.php
allows authenticated users to read other user’s assignments. This is possible because it lacks access restrictions during the processing of ZIP assignment-archive download requests.
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38443
lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html
openwall.com/lists/oss-security/2013/05/21/1
moodle.org/mod/forum/discuss.php?d=228930