CVE-2024-48896

Moodle: users' names returned in messaging error message

State: Published
Severity: 4.3 Medium
Published: Nov 18, 2024
Updated: Nov 18, 2024
Reserved: Oct 9, 2024

Description

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
moodle	4.4.0 to before 4.4.4Affected 4.3.0 to before 4.3.8Affected 4.2.0 to before 4.2.11Affected 4.1.0 to before 4.1.14Affected before 4.1.0Affected

References

RHBZ#2318822issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.