| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 2.7.0, < 2.7.12≥ 2.8.0, < 2.8.10≥ 2.9.0, < 2.9.4≥ 3.0.0, < 3.0.2≤ 2.6.11 | 2.7.122.8.102.9.43.0.2 |
| moodle | = 2.7.0= 2.7.1= 2.7.10= 2.7.11= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.8.9= 2.9.0= 2.9.1= 2.9.2= 2.9.3= 3.0.0= 3.0.1≤ 2.6.11 |
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free