Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.0

Moodle: E-mail addresses exposed to authenticated users

CVE-2014-0124 · published 12 years ago
Summary

Some Moodle versions don't properly hide email addresses in certain modules. This means that users with a Moodle account can see email addresses that shouldn't be publicly visible. You should update to a fixed version of Moodle to prevent this.

What to do
  • Update moodle moodle to version 2.4.9.
  • Update moodle moodle to version 2.5.5.
  • Update moodle moodle to version 2.6.2.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle < 2.4.9
>= 2.5.0, < 2.5.5
>= 2.6.0, < 2.6.2
Fix: upgrade to 2.4.9
– moodle moodle <= 2.3.11
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
49 more version ranges
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Original advisory text
The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not prope...
The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.
References
Severity
4.0 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published24 Mar 2014
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-fc5p-vj3h-x7g4 · GHSA
CVE-2014-0124 · NVD
Track software like this
Free during beta