{"id":"CVE-2011-4288","aliases":["DSA-2262-1","EUVD-2011-4227","GHSA-qq3m-44fg-p6q8"],"status":"published","title":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations...","description":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01674,"percentile":0.76991,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2011-06-16T00:00:00Z","modified":"2026-06-16T23:34:42Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9.dfsg2-2.1+squeeze1"}]}],"versions":["1.9.9.dfsg2-2.1"],"bundled":6}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://openwall.com/lists/oss-security/2011/11/14/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=79c6e3a0968ee1fedcf8a1f14f8086fcd9dbd3f6","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://moodle.org/mod/forum/discuss.php?d=175590","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4288"},{"url":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=79c6e3a0968ee1fedcf8a1f14f8086fcd9dbd3f6"},{"url":"https://github.com/advisories/GHSA-qq3m-44fg-p6q8"}],"sources":{"cve":[{"id":"CVE-2011-4288","description":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.","status":"published","published":"2012-07-16T10:00:00Z","modified":"2024-08-07T00:01:51.584Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2011-4227","description":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.","status":"published","published":"2012-07-16T10:00:00Z","modified":"2024-08-07T00:01:51Z","updated_at":"2026-11-03T01:39:49.441333Z"}],"ghsa":[{"id":"GHSA-qq3m-44fg-p6q8","title":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations...","description":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.","status":"published","published":"2022-05-13T01:13:09Z","modified":"2023-02-13T06:32:09Z","updated_at":"2026-11-02T14:54:06.501947Z"}],"nvd":[{"id":"CVE-2011-4288","description":"Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.","status":"published","published":"2012-07-16T10:28:36.783Z","modified":"2026-06-16T23:34:42.59Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:12.272092Z"}],"osv":[{"id":"DSA-2262-1","title":"moodle - several","status":"published","published":"2011-06-16T00:00:00Z","modified":"2026-03-09T01:20:01.497922Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}