CVE-2009-4298: Infoleak
Published Dec 16, 2009
·Updated
The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.
Affected Software
15 affected components
Moodle moodle=1.8.1
Moodle moodle=1.8.2
Moodle moodle=1.8.3
Moodle moodle=1.8.4
Moodle moodle=1.8.5
Moodle moodle=1.8.7
Moodle moodle=1.8.8
Moodle moodle=1.8.9
Moodle moodle=1.8.10
Moodle moodle=1.9.1
Moodle moodle=1.9.2
Moodle moodle=1.9.3
Moodle moodle=1.9.4
Moodle moodle=1.9.5
Moodle moodle=1.9.6
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 16, 2009
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4298?
CVE-2009-4298 carries a medium severity rating as it allows attackers to access sensitive user information.
2
How do I fix CVE-2009-4298?
To fix CVE-2009-4298, users should upgrade to Moodle version 1.8.11 or 1.9.7 or later.
3
Which Moodle versions are affected by CVE-2009-4298?
CVE-2009-4298 affects Moodle versions 1.8 before 1.8.11 and 1.9 before 1.9.7.
4
What type of information can be obtained through CVE-2009-4298?
CVE-2009-4298 allows attackers to obtain user account information such as usernames and personal names stored in the user table.
5
Is there a known workaround for CVE-2009-4298?
There is no known workaround for CVE-2009-4298 other than updating to the recommended patched versions.