What is GHSA-hh52-g5c4-wprh?

GHSA-hh52-g5c4-wprh is a security advisory published by GitHub Security Advisories with Medium severity. Moodle may allow authenticated users to enumerate other user's names via learning plans page

Which CVE IDs does GHSA-hh52-g5c4-wprh cover?

GHSA-hh52-g5c4-wprh covers the following CVE IDs: CVE-2023-28334. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hh52-g5c4-wprh?

GHSA-hh52-g5c4-wprh has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hh52-g5c4-wprh?

GHSA-hh52-g5c4-wprh affects 4 products, including: composer/moodle/moodle:\u003e= 4.1.0, \u003c 4.1.2; composer/moodle/moodle:\u003e= 4.0.0, \u003c 4.0.7; composer/moodle/moodle:\u003e= 3.11.0, \u003c 3.11.13; composer/moodle/moodle:\u003c 3.9.20.

GHSA-hh52-g5c4-wprhMediumCVSS 4.3

Moodle may allow authenticated users to enumerate other user's names via learning plans page

Vendor

GitHub Security Advisories

Published

March 23, 2023

Last Modified

April 29, 2024

🔗 CVE IDs covered (1)

CVE-2023-28334 →

📋 Description

Authenticated users were able to enumerate other users' names via the learning plans page.

🎯 Affected products4

composer/moodle/moodle:>= 4.1.0, < 4.1.2
composer/moodle/moodle:>= 4.0.0, < 4.0.7
composer/moodle/moodle:>= 3.11.0, < 3.11.13
composer/moodle/moodle:< 3.9.20

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2023-28334
https://moodle.org/mod/forum/discuss.php?d=445066
https://github.com/moodle/moodle/commit/0e3c8eb740e1e49a62a5f452cda7e06258712bbf
https://git.moodle.org/gw?p=moodle.git;a=commit;h=0e3c8eb740e1e49a62a5f452cda7e06258712bbf
https://bugzilla.redhat.com/show_bug.cgi?id=2179423
https://github.com/advisories/GHSA-hh52-g5c4-wprh