CVE-2012-2353
Moodle Exposes Sensitive User Information
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
Exploit likelihood
What each source reports
NVD Score used
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
CVE-2012-2353- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
CVE-2012-2353- Updated
- 2026-11-02
EUVDEUVD-2022-4618 No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
EUVD-2022-4618- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mr97-gvvg-rhgh No score
Moodle Exposes Sensitive User Information
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
GHSA-mr97-gvvg-rhgh- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-mr97-gvvg-rhgh No score
Moodle Exposes Sensitive User Information
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
GHSA-mr97-gvvg-rhgh- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2353 No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
- Record
UBUNTU-CVE-2012-2353- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moodle/moodlePackagist |
2.1 up to 2.1.6 | 2.1.6 |
moodle/moodlePackagist |
2.2 up to 2.2.3 | 2.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2353 is a medium vulnerability (CVSS 4.0) in Moodle, published July 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in moodle/moodle 2.1.6.
References
openwall.com/lists/oss-security/2012/05/23/2
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31923
nvd.nist.gov/vuln/detail/CVE-2012-2353
github.com/moodle/moodle/commit/a645b79113b2ee7881b6bdae64a0c2a9f04db5c7