Boletines de Vulnerabilidades

MSA-20-0021: The participants table download feature did not respect the sites "show user identity" configuration


Información sobre el sistema

   
Software afectado PHP

Descripción

by Michael Hawkins. The participants table download always included user emails, but should have only done so when users emails are not hidden.Severity/Risk:MinorVersions affected:3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8Versions fixed:3.10, 3.9.3, 3.8.6 and 3.7.9Reported by:A. SchenkelCVE identifier:CVE-2020-25703Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69844Tracker issue:MDL-69844 The participants table download feature did not

More info:

https://moodle.org/mod/forum/discuss.php?d=413941&parent=1668777

Identificadores estándar

Propiedad Valor
CVE CVE-2020-25703.

Histórico de versiones

Versión Comentario Data
1.0 Advisory issued 2020-11-17
Ministerio de Defensa
CNI
CCN
CCN-CERT