{"id":"CVE-2009-4298","aliases":["DSA-1986-1","EUVD-2009-4266","GHSA-qc37-hv35-h42x"],"status":"published","title":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1)...","description":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0161,"percentile":0.76103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2009-12-16T01:00:00Z","modified":"2026-06-16T23:13:23Z","affected":[{"source":"osv","ecosystem":"Debian:5.0","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2.dfsg-3+lenny3"}]}],"versions":["1.8.2.dfsg-3","1.8.2.dfsg-3+lenny1","1.8.2.dfsg-3+lenny2"],"bundled":7}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://docs.moodle.org/en/Moodle_1.9.7_release_notes","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://docs.moodle.org/en/Moodle_1.8.11_release_notes","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.vupen.com/english/advisories/2009/3455","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/37614","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://moodle.org/mod/forum/discuss.php?d=139102","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/37244","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4298"},{"url":"https://github.com/advisories/GHSA-qc37-hv35-h42x"}],"sources":{"cve":[{"id":"CVE-2009-4298","description":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.","status":"published","published":"2009-12-16T01:00:00Z","modified":"2024-09-17T03:02:42.821Z","updated_at":"2026-11-02T14:33:24.782697Z"}],"euvd":[{"id":"EUVD-2009-4266","description":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.","status":"published","published":"2009-12-16T01:00:00Z","modified":"2024-09-17T03:02:42Z","updated_at":"2026-11-03T00:28:35.090816Z"}],"ghsa":[{"id":"GHSA-qc37-hv35-h42x","title":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1)...","description":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.","status":"published","published":"2022-05-02T03:53:17Z","modified":"2023-01-31T05:08:36Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:49:25.675023Z"}],"nvd":[{"id":"CVE-2009-4298","description":"The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.","status":"published","published":"2009-12-16T01:30:00.327Z","modified":"2026-06-16T23:13:23.48Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:37.939838Z"}],"osv":[{"id":"DSA-1986-1","title":"moodle - several vulnerabilities","status":"published","published":"2010-02-02T00:00:00Z","modified":"2026-03-09T01:21:27.020963Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}