CVE-2011-4593: Infoleak

Published Jul 20, 2012

Updated

Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/actionredir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.

Affected Software

23 affected components

Moodle moodle=1.9.4

Moodle moodle=1.9.1

Moodle moodle=1.9.6

Moodle moodle=1.9.9

Moodle moodle=1.9.11

Moodle moodle=1.9.2

Moodle moodle=1.9.12

Moodle moodle=1.9.10

Moodle moodle=1.9.3

Moodle moodle=1.9.13

Moodle moodle=1.9.5

Moodle moodle=1.9.14

Moodle moodle=1.9.8

Moodle moodle=1.9.7

Moodle moodle=2.0.2

Moodle moodle=2.0.1

Moodle moodle=2.0.4

Moodle moodle=2.0.3

Moodle moodle=2.0.5

Moodle moodle=2.0.0

Moodle moodle=2.1.2

Moodle moodle=2.1.1

Moodle moodle=2.1.0

Remediation

Patch Available

http://moodle.org/mod/forum/discuss.php?d=191762

Event History

Jul 20, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4593?

CVE-2011-4593 has been classified as a medium severity vulnerability due to its potential to expose email addresses to unauthorized users.

How do I fix CVE-2011-4593?

To fix CVE-2011-4593, upgrade your Moodle installation to version 1.9.15, 2.0.6, or 2.1.3 or later.

Who is affected by CVE-2011-4593?

CVE-2011-4593 affects users of Moodle versions prior to 1.9.15, 2.0.6, and 2.1.3.

What is the impact of CVE-2011-4593?

The impact of CVE-2011-4593 allows remote authenticated users to discover email addresses via the messaging interface.

Is there a workaround for CVE-2011-4593?

There are no specific workarounds for CVE-2011-4593, so updating to a patched version is the best approach.