Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-10889

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.

Published

2018-07-10T18:29:00.233

Last Modified

2024-11-21T03:42:13.950

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-532
Type: Primary
CWE-532

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	moodle	moodle	< 3.3.7	Yes
Application	moodle	moodle	< 3.4.4	Yes
Application	moodle	moodle	< 3.5.1	Yes

References

http://www.securityfocus.com/bid/104733 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://moodle.org/mod/forum/discuss.php?d=373369 Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/104733 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://moodle.org/mod/forum/discuss.php?d=373369 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)