Miembros de
Boletines de Vulnerabilidades |
MSA-24-0045: Users names returned in messaging error message |
|
| Software afectado | PHP |
|
by Michael Hawkins. It was possible for users with the "send message" capability to view other users names they may not otherwise have access to, via an error message in Messaging. (Note: The name returned followed the full name format configured on the site).Severity/Risk:MinorVersions affected:4.4 to 4.4.3, 4.3 to 4.3.7, 4.2 to 4.2.10, 4.1 to 4.1.13 and earlier unsupported versionsVersions fixed:4.4.4, 4.3.8, 4.2.11 and 4.1.14Reported by:Bruno Kirschner (Recurity Labs)CVE More info: https://moodle.org/mod/forum/discuss.php?d=462874&parent=1858332 |
|
