| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 2.8.0, < 2.8.11≥ 2.9.0, < 2.9.5≥ 3.0.0, < 3.0.3< 2.7.13 | 2.8.112.9.53.0.32.7.13 |
| moodle | = 2.7.0= 2.7.1= 2.7.10= 2.7.11= 2.7.12= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.10= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.8.9= 2.9.0= 2.9.1= 2.9.2= 2.9.3= 2.9.4= 3.0.0= 3.0.1= 3.0.2≤ 2.6.11 |
lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free