CVE-2023-5542
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
CVE-2023-5542- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2023-2926
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
EUVD-2023-2926- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mm2-m2gp-c6x2
Moodle Improper Access Control vulnerability
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
GHSA-8mm2-m2gp-c6x2- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284, CWE-668
- Updated
- 2026-11-02
NVD
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
CVE-2023-5542- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284, CWE-668
- Updated
- 2026-11-02
OSV
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
CVE-2023-5542- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-8mm2-m2gp-c6x2
Moodle Improper Access Control vulnerability
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
GHSA-8mm2-m2gp-c6x2- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-284, CWE-668
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5542
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
UBUNTU-CVE-2023-5542- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-moodle-2023-5542 No score
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
- Record
BIT-moodle-2023-5542- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
before 4.3.0-rc2 | 4.3.0-rc2 |
moodleBitnami |
4.2.2 up to 4.2.3 | 4.2.3 |
moodle/moodlePackagist |
before 4.3.0-rc2, plus listed versions v2.3.10v2.3.11v2.3.4v2.3.5v2.3.6 Show 45 moreShow lessv2.3.7v2.3.8v2.3.9v2.4.0v2.4.0-rc1v2.4.1v2.4.10v2.4.11v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.4.9v2.5.0v2.5.0-betav2.5.0-rc1v2.5.1v2.5.2v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.8v2.5.9v2.6.0v2.6.0-betav2.6.0-rc1v2.6.1v2.6.10v2.6.11v2.6.2v2.6.3v2.6.4v2.6.5v2.6.6v2.6.7v2.6.8v2.6.9v2.7.0v2.7.0-betav2.7.0-rc1 |
4.3.0-rc2 |
moodleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.7.9+dfsg-12.7.10+dfsg-12.7.11+dfsg-12.7.11+dfsg-22.7.12+dfsg-13.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
moodleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.0.3+dfsg-0ubuntu13.0.3+dfsg-0ubuntu1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5542 is a low vulnerability (CVSS 3.3) in Moodle, published November 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in moodle/moodle 4.3.0-rc2.
References
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79213
bugzilla.redhat.com/show_bug.cgi?id=2243441
moodle.org/mod/forum/discuss.php?d=451583
nvd.nist.gov/vuln/detail/CVE-2023-5542
github.com/moodle/moodle/commit/b0bb97ee3b481dd85d8f1ed3612f70c9d1939014
Left out here: 322 versions. The JSON record has them.