Moodle included private user files in course backups

MEDIUM 4.3CVE-2012-1159 · GHSA-p9hr-f4xj-8w8r · Published 14/11/2019 · updated 16/06/2026

In short

CVE-2012-1159 is a MEDIUM (CVSS 4.3) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.9% of all vulnerabilities.
Fix: update to 2.0.8, 2.1.5, 2.2.2, 1.9.17 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 2.0, < 2.0.8≥ 2.1, < 2.1.5≥ 2.2, < 2.2.2< 1.9.17`	`2.0.82.1.52.2.21.9.17`
moodle moodle	`< 2.2.2`	`2.2.2`

Moodle before 2.2.2 is vulnerable to information disclosure because course backups were including users' private files.

NVD description

Moodle before 2.2.2: Overview report allows users to see hidden courses

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 2.0, < 2.0.8≥ 2.1, < 2.1.5≥ 2.2, < 2.2.2< 1.9.17

2.0.82.1.52.2.21.9.17

< 2.2.2

2.2.2

More vulnerabilities in moodle/moodle

See all →