CVE-2024-48896CWE-209

Moodle: users' names returned in messaging error message

Medium · published November 18, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2024-11-18T11:13Z
EPSS history
Timeline
  • 18 NOV 11:13Z
    Moodle: users' names returned in messaging error message
    cvelistv5