Information disclosure in Moodle

CVE-2013-1829

calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.

Vulnerability class: Information Disclosure

EPSS: 0.011 (62.8th percentile) — read the EPSS interpretation.

Affected products

Moodle — versions 2.4.0, 2.4.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST)