CVE-2023-28336

MEDIUM

Moodle 3.9.0-3.9.19 and 4.1.0-4.1.1 - Exposure of Sensitive Information via Grade Report History

Title source: llm

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

Core 3

Core References

Patch, Vendor Advisory

Issue Tracking issue-tracking x_refsource_redhat

Mailing List, Third Party Advisory vendor-advisory

CVSS v3 4.3

EPSS 0.0074

EPSS Percentile 49.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-200 CWE-668

Status published

Products (8)

fedoraproject/fedora 36

moodle/moodle 3.9.0

moodle/moodle 3.11.0

moodle/moodle 4.0.0

moodle/moodle 4.1.0

moodle/moodle 4.1.1

moodle/moodle 3.9.0 - 3.9.20

moodle/moodle 4.1.0 - 4.1.2Packagist

Published Mar 23, 2023

Tracked Since Feb 18, 2026