{"id":"CVE-2014-3617","aliases":["EUVD-2022-4686","GHSA-p5j7-26wj-423j","MGASA-2014-0379"],"status":"published","title":"Moodle allows discovery of an author's username","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01143,"percentile":0.66935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-09-15T10:36:30Z","modified":"2026-06-17T00:08:37Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.5.8","2.6.5","2.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:3","package":"moodle","fixed_in":["2.6.5-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"moodle","fixed_in":["2.6.5-1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8"}]}],"versions":["v2.3.10","v2.3.11","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v2.4.0","v2.4.0-rc1","v2.4.1","v2.4.10","v2.4.11","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.0-beta","v2.5.0-rc1","v2.5.1","v2.5.2","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.5"}]}],"versions":["v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4"]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.2"}]}],"versions":["v2.7.0","v2.7.1"]},{"source":"osv","ecosystem":"Mageia:3","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.5-1.mga4"}]}]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-46619","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2014/09/15/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=269591","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3617","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/1c5d2aefd1c6706176e97b99b2f9deef582564be","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/1f3066f1977cf9ba36bb2583597af8bc53eb7d0f","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/532c25d5bd6d0f2ad14720fcee0da8c879c4d0f2","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/8f2e80600bf0fc220b92706907fb3d683602e5c2","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/95c3874b717e19711780147c29285e56ca01ff79","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/982c8524dd27066a6893a4b2ff2c41d60f9bdc23","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/a80ed84ed37d24e564b0bb7b8d51c4206b1fcd54","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/b1325427ecefb23002d3c79a7222e98f3995c0fb","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/b2b8d932f11c089b59b6c5ce439487ae3e5d79aa","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/ebbff905629fbd87a6a81cc471964e995fba3eb0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p5j7-26wj-423j"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0379.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14081","tags":["report"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=269590","tags":["web"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=269089","tags":["web"]},{"url":"https://docs.moodle.org/dev/Moodle_2.6.5_release_notes","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3617","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","status":"published","published":"2014-09-15T14:00:00Z","modified":"2024-08-06T10:50:17.677Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2022-4686","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","status":"published","published":"2014-09-15T14:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-p5j7-26wj-423j","title":"Moodle allows discovery of an author's username","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","status":"published","published":"2022-05-13T01:12:42Z","modified":"2024-02-02T05:07:43Z","updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2014-3617","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","status":"published","published":"2014-09-15T14:55:11.54Z","modified":"2026-06-17T00:08:37.66Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:55.884979Z"}],"osv":[{"id":"GHSA-p5j7-26wj-423j","title":"Moodle allows discovery of an author's username","description":"The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q\u0026A forum.","status":"published","published":"2022-05-13T01:12:42Z","modified":"2024-12-07T05:38:10.293721Z","updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"MGASA-2014-0379","title":"Updated moodle packages fix security vulnerbilities","description":"Updated moodle packages fix security vulnerabilities:\n\nIn Moodle before 2.6.5, users who had not yet posted the required answer in\na Q\u0026A forum in order to access past posts were able to see the name of the\nlast person who had posted, as other authors are visible in\n/mod/forum/view.php before the student has posted their own answer\n(CVE-2014-3617).\n","status":"published","published":"2014-09-15T10:36:30Z","modified":"2026-04-16T06:25:35.512533626Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}