Moodle exposes hidden grades to students

MEDIUM 4.0CVE-2014-7831 · GHSA-59j6-8g7w-prf7 · Published 24/11/2014 · updated 17/06/2026

In short

CVE-2014-7831 is a MEDIUM (CVSS 4.0) vulnerability affecting moodle/moodle, moodle (moodle).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.9% of all vulnerabilities.
Fix: update to 2.7.3 or later.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 2.7.0, < 2.7.3`	`2.7.3`
moodle moodle	`= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.5.7= 2.5.8= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.7.0= 2.7.1= 2.7.2≤ 2.4.11`	No fix yet

Description

lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-7831 · ADVISORY
moodle/moodle commit 3b8876f · WEB
moodle/moodle · PACKAGE
moodle.org/mod/forum/discuss.php · WEB
web.archive.org/web/20150914064838/http://www.securitytracker.com/id/1031215 · WEB
git.moodle.org/gw · WEB
openwall.com/lists/oss-security/2014/11/17/11 · WEB
securitytracker.com/id/1031215

More vulnerabilities in moodle/moodle

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moodle/moodle

Packagist

≥ 2.7.0, < 2.7.3

2.7.3

moodle

= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.5.6= 2.5.7= 2.5.8= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.6.5= 2.7.0= 2.7.1= 2.7.2≤ 2.4.11

No fix yet

Description

NVD description

More vulnerabilities in moodle/moodle

See all →