Vulnerability Bulletins |
MSA-24-0045: Users names returned in messaging error message |
|
| Affected software | PHP |
|
par Michael Hawkins. It was possible for users with the "send message" capability to view other users names they may not otherwise have access to, via an error message in Messaging. (Note: The name returned followed the full name format configured on the site).Severity/Risk:MinorVersions affected:4.4 to 4.4.3, 4.3 to 4.3.7, 4.2 to 4.2.10, 4.1 to 4.1.13 and earlier unsupported versionsVersions fixed:4.4.4, 4.3.8, 4.2.11 and 4.1.14Reported by:Bruno Kirschner (Recurity Labs)CVE More info: https://moodle.org/mod/forum/discuss.php?d=462874&parent=1858332 |
|