Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Moodle: Unintentional Exposure of User Interaction in Data Exports

CVE-2018-10889 · published 8 years ago
Summary

Moodle versions prior to 3.5.1, 3.4.4, and 3.3.7 may leak information about interactions between users. This could potentially reveal sensitive information about other users to those who export data. To address this, update to the latest version of Moodle or configure data privacy exports to exclude logs.

What to do
  • Update moodle moodle to version 3.5.1.
  • Update moodle moodle to version 3.4.4.
  • Update moodle moodle to version 3.3.7.
Affected software
Ecosystem VendorProductAffected versions
composer moodle moodle 3.5
3.4.3
>= 3.3, <= 3.3.6
Fix: upgrade to 3.5.1
– moodle moodle >= 3.3.0, < 3.3.7
>= 3.4.0, < 3.4.4
>= 3.5.0, < 3.5.1
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Original advisory text
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published10 Jul 2018
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-wmvq-q9h8-7j4g · GHSA
CVE-2018-10889 · NVD
Track software like this
Free during beta