CVE-2024-48896

CVE-2024-48896: Moodle: users' names returned in messaging error message

Weakness CWE-209 · Error message info leak

Published November 18, 2024

Last update November 18, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

Key dates

02Disclosure timeline

November 18, 2024 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-48896 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/209.html

Related vulnerabilities

04Related CVE

CVE-2018-10624 Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information CVE-2023-47152 IBM Db2 information disclosure CVE-2025-47813 CVE-2026-33065 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVE-2025-36090 IBM Analytics Content Hub information disclosure