← Back

CVE-2023-28336

nvd nist
Published: Mar 23, 2023Modified: Nov 21, 2024

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

Affected (9)

Moodle
1 product
Moodle
Fedoraproject
1 product
Fedora
Configuration A
8 vulnerable
Vulnerable SoftwareAffected Versions
Moodle
Moodle
After 3.11.0 to 3.11.13
Moodle
After 3.9.0 to 3.9.20
Moodle
After 4.0.0 to 4.0.7
Moodle
Version 3.11.0
Moodle
Version 3.9.0
Moodle
Version 4.0.0
Moodle
Version 4.1.0
Moodle
Version 4.1.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 36

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-668
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References (6)

Source: patrick@puiterwijk.org
Source: patrick@puiterwijk.org
Source: patrick@puiterwijk.org
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.