Moodle is vulnerable to information disclosure. The attacks exist because it ignores “don’t send” attributes. As a result of ignoring these attributes the site sends sensitive information to remote hub even though it shouldn’t have.
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822
lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html
openwall.com/lists/oss-security/2013/05/21/1
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822
moodle.org/mod/forum/discuss.php?d=228933