In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on
    the Participants page, students could search email addresses of all participants regardless of email
    visibility. This allows enumerating and guessing emails of other students. (CVE-2017-15110)

Fix for CVE-2017-15110.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434327	SCA: security update for moodle/moodle (GHSA-rjh8-w8jg-xwq5)	Tenable Cloud Security	SCA Checks	medium
434327	SCA: security update for moodle/moodle (GHSA-rjh8-w8jg-xwq5)	Tenable Self-Hosted Container Security	SCA Checks	medium
105890	Fedora 27 : moodle (2017-612d3e009f)	Nessus	Fedora Local Security Checks	medium
104981	Fedora 25 : moodle (2017-e40e02e0dd)	Nessus	Fedora Local Security Checks	medium
104942	Fedora 26 : moodle (2017-475529a26a)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-15110

medium

Tenable Plugins

medium

medium

medium

medium

medium