REDHAT-BUG-2356829: High severity moodle vulnerability
On certain Moodle sites, it was possible to retrieve user data, including names, contact information, and hashed passwords, via a stack trace returned by an API call. Sites with PHP configured with zend.exceptionignoreargs = 1 in the php.ini file are not affected by this vulnerability.
Versions affected: 4.5 to 4.5.2 Versions fixed: 4.5.3
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2356829?
REDHAT-BUG-2356829 is classified as a critical vulnerability due to the potential exposure of sensitive user data.
How do I fix REDHAT-BUG-2356829?
To fix REDHAT-BUG-2356829, ensure that your PHP configuration has zend.exception_ignore_args set to 1 in the php.ini file.
Which versions of Moodle are affected by REDHAT-BUG-2356829?
Moodle versions between 4.5 and 4.5.2 are affected by REDHAT-BUG-2356829.
What type of user data can be exposed due to REDHAT-BUG-2356829?
User data that can be exposed includes names, contact information, and hashed passwords due to the vulnerability in the API.
Are all Moodle sites vulnerable to REDHAT-BUG-2356829?
No, sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not vulnerable to REDHAT-BUG-2356829.