Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• abraxaslabs.tech/research/moodle-grades-feedback-idor Üçüncü taraf
• vulncheck.com/…mation-disclosure-via-core-grades-get-feedback Üçüncü taraf
• github.com/…public/grade/classes/external/get_feedback.php Diğer
• github.com/moodle/moodle Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:31Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-119556Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
• 5,9 CVE-2026-119554Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
• 6,5 CVE-2026-119553Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
• 4,3 CVE-2026-119547Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
• 3,1 CVE-2026-119548Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
• 5,9 CVE-2026-119421Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation