CVE-2023-1402
Moodle: course participation report shows roles the user should not see
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
CVE-2023-1402- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-668
- Updated
- 2026-11-02
CVE List No score
Moodle: course participation report shows roles the user should not see
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
CVE-2023-1402- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-1114 No score
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
EUVD-2023-1114- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vj5p-fp42-774p
Moodle may display roles to users who don't have access to them
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
GHSA-vj5p-fp42-774p- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-668
- Updated
- 2026-11-02
OSVGHSA-vj5p-fp42-774p
Moodle may display roles to users who don't have access to them
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
GHSA-vj5p-fp42-774p- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-668
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-1402
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
UBUNTU-CVE-2023-1402- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2023-1402 No score
Moodle: course participation report shows roles the user should not see
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
BIT-moodle-2023-1402- Updated
- 2026-11-02
OSV No score
Moodle: course participation report shows roles the user should not see
The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
- Record
CVE-2023-1402- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
4.1.0 up to 4.1.2 | 4.1.2 |
moodle/moodlePackagist |
4.0.0 up to 4.0.7 | 4.0.7 |
moodle/moodlePackagist |
3.11.0 up to 3.11.13 | 3.11.13 |
moodle/moodlePackagist |
before 3.9.20 | 3.9.20 |
moodleBitnami |
3.9.0 up to 3.9.20, 3.11.0 up to 3.11.13, 4.0.0 up to 4.0.7, 4.1.0 up to 4.1.2 | 3.9.203.11.134.0.74.1.2 |
moodle/moodlePackagist |
4.1.0 up to 4.1.2, plus listed versions v4.1.0v4.1.1 |
4.1.2 |
moodle/moodlePackagist |
4.0.0 up to 4.0.7, plus listed versions v4.0.0v4.0.1v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6 |
4.0.7 |
moodle/moodlePackagist |
3.11.0 up to 3.11.13, plus listed versions v3.11.0v3.11.1v3.11.10v3.11.11v3.11.12 Show 8 moreShow lessv3.11.2v3.11.3v3.11.4v3.11.5v3.11.6v3.11.7v3.11.8v3.11.9 |
3.11.13 |
moodle/moodlePackagist |
before 3.9.20, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
3.9.20 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-1402 is a medium vulnerability (CVSS 4.3) in Moodle, published March 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 55th percentile. Fixed in moodle/moodle 4.1.2.
References
bugzilla.redhat.com/show_bug.cgi?id=2179427
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QZN34VSF4HTCW3C3ZP2OZYSLYUKADPF
moodle.org/mod/forum/discuss.php?d=445069
nvd.nist.gov/vuln/detail/CVE-2023-1402
github.com/moodle/moodle/commit/f0a557bffbdb450648d0e4cedb391d14d8a0a253
git.moodle.org/gw?p=moodle.git;a=commitdiff;h=f0a557bffbdb450648d0e4cedb391d14d8a0a253
Show 7 moreShow less
ubuntu.com/security/CVE-2023-1402
cve.org/CVERecord?id=CVE-2023-1402
Left out here: 217 versions. The JSON record has them.