| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 2.8.0, < 2.8.9≥ 2.9.0, < 2.9.3< 2.7.11 | 2.8.92.9.32.7.11 |
| moodle | = 2.7.0= 2.7.1= 2.7.10= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 2.9.0= 2.9.1= 2.9.2≤ 2.6.11 |
The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free