CVE-2024-48896

MEDIUM

Moodle < 4.1.14 - Unauthorized User Name Disclosure via Messaging Error Message

Title source: llm
STIX 2.1

Description

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

References (1)

Core 1
Core References
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2318822

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 28.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-209
Status published
Products (2)
moodle/moodle < 4.1.14
moodle/moodle 0 - 4.1.14Packagist
Published Nov 18, 2024
Tracked Since Feb 18, 2026