CVE-2023-28334 Moodle: users' name enumeration possible via idor on learning plans page

2023-03-2300:00:00

CWE-200

fedora

github.com

cve-2023-28334

moodle

users' name enumeration

idor

learning plans page

authenticated users

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

21.0%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Authenticated users were able to enumerate other users’ names via the learning plans page.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "moodle",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.0.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:moodle:moodle:4.1.0:-:*:*:*:*:*:*"
    ],
    "vendor": "moodle",
    "product": "moodle",
    "versions": [
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]