Description

Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.

Remediation

References

CVE-2011-4289

Related Vulnerabilities

Oracle Database Server Other Vulnerability (CVE-2005-3437)

MediaWiki Other Vulnerability (CVE-2004-2187)

WordPress Plugin 301 Redirects-Easy Redirect Manager Cross-Site Request Forgery (2.72)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-2978)

WordPress Plugin ComicPress Manager 'lang' Parameter Cross-Site Scripting (1.4.9.9)

Severity

Medium

Classification

CVE-2011-4289 CWE-264

Tags

Missing Update Known Vulnerabilities