CVE-2024-43429

Moodle: user information visibility control issues in gradebook reports

State: Published
Severity: 5.3 Medium
Published: Nov 11, 2024
Updated: Nov 12, 2024
Reserved: Aug 13, 2024

Description

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	fedora

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
moodle	before 4.1.12Affected 4.2 to before 4.2.9Affected 4.3 to before 4.3.6Affected 4.4 to before 4.4.2Affected

References

RHBZ#2304257issue-tracking
https://moodle.org/mod/forum/discuss.php?d=461197

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.