It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

Affected Packages

Packagist moodle/moodle

Affected versions: 3.10.0 (fixed in 3.10.2)

Packagist moodle/moodle

Affected versions: 3.9.0 (fixed in 3.9.5)

Packagist moodle/moodle

Affected versions: 3.8.0 (fixed in 3.8.8)

Packagist moodle/moodle

Affected versions: 3.5 (fixed in 3.5.17)

Related CVEs

CVE-2021-20281

Key Information

GHSA ID

GHSA-93wh-35r4-6qmw

Published

March 29, 2021 8:43 PM

Last Modified

August 11, 2022 4:37 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

moodle/moodle

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 15, 2025 6:24 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.