CVE-2011-4284: Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page
Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context page.
Other sources
Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4284?
CVE-2011-4284 has a moderate severity rating as it allows remote attackers to access sensitive information.
How do I fix CVE-2011-4284?
To fix CVE-2011-4284, upgrade your Moodle installation to version 2.0.2 or later.
What versions of Moodle are affected by CVE-2011-4284?
CVE-2011-4284 affects Moodle versions 2.0.0 and 2.0.1.
What type of attack does CVE-2011-4284 enable?
CVE-2011-4284 enables remote attackers to obtain sensitive information from the myprofile block.
Is there a workaround for CVE-2011-4284?
There are no official workarounds for CVE-2011-4284; patching to a secure version is recommended.