CVE-2017-12157: Infoleak
Published Sep 18, 2017
·Updated
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
Affected Software
47 affected componentsFixes available
composer/moodle/moodle<=3.1.7
3.1.8
composer/moodle/moodle>=3.2.0<=3.2.4
3.2.5
composer/moodle/moodle>=3.3.0<=3.3.1
3.3.2
Moodle moodle=3.0.0
Moodle moodle=3.0.0-beta
Moodle moodle=3.0.0-rc1
Moodle moodle=3.0.0-rc2
Moodle moodle=3.0.0-rc3
Moodle moodle=3.0.0-rc4
Moodle moodle=3.0.1
Moodle moodle=3.0.2
Moodle moodle=3.0.3
Moodle moodle=3.0.4
Moodle moodle=3.0.5
Moodle moodle=3.0.6
Moodle moodle=3.0.7
Moodle moodle=3.0.8
Moodle moodle=3.0.9
Moodle moodle=3.0.10
Moodle moodle=3.1.0
Moodle moodle=3.1.0-beta
Moodle moodle=3.1.0-rc1
Moodle moodle=3.1.0-rc2
Moodle moodle=3.1.1
Moodle moodle=3.1.2
Moodle moodle=3.1.3
Moodle moodle=3.1.4
Moodle moodle=3.1.5
Moodle moodle=3.1.6
Moodle moodle=3.1.7
Moodle moodle=3.2.0
Moodle moodle=3.2.0-beta
Moodle moodle=3.2.0-rc1
Moodle moodle=3.2.0-rc2
Moodle moodle=3.2.0-rc3
Moodle moodle=3.2.0-rc4
Moodle moodle=3.2.0-rc5
Moodle moodle=3.2.1
Moodle moodle=3.2.2
Moodle moodle=3.2.3
Moodle moodle=3.2.4
Moodle moodle=3.3.0
Moodle moodle=3.3.0-beta
Moodle moodle=3.3.0-rc1
Moodle moodle=3.3.0-rc2
Moodle moodle=3.3.0-rc3
Moodle moodle=3.3.1
Remediation
Patch Available
Event History
Sep 18, 2017
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
DescriptionWeakness
May 17, 2022
Advisory Published
12:47 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-12157?
CVE-2017-12157 is considered a medium severity vulnerability due to unauthorized information disclosure.
2
How do I fix CVE-2017-12157?
To fix CVE-2017-12157, upgrade to a patched version of Moodle that addresses this vulnerability.
3
What versions of Moodle are affected by CVE-2017-12157?
CVE-2017-12157 affects Moodle versions 3.0.0 through 3.3.1.
4
What type of vulnerability is CVE-2017-12157?
CVE-2017-12157 is a vulnerability that allows teachers to view details about users in groups they cannot access.
5
Is there a public exploit for CVE-2017-12157?
As of now, there is no known public exploit for CVE-2017-12157.