Medium
Security advisory
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-15110
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:09 UTC · Revision 1
Source evidence
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
osv:CVE-2017-15110
Complete source record
{
"id": "842de0731a3bf297790efda5be932b6fdb63ac2985816e51128f21ce1e7460e0",
"url": "https://osv.dev/vulnerability/CVE-2017-15110",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-15110",
"summary": "In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.",
"evidence": "osv:CVE-2017-15110",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-15110",
"aliases": [
"CVE-2017-15110",
"GHSA-rjh8-w8jg-xwq5"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0bd0ee444a07818fc495c95697ea1ec1a6abeefb"
},
{
"introduced": "268abfacc54c4cbf9722c1502569b311c7caefff"
},
{
"last_affected": "25fd679aafe60922261dee4a3e24c7b3ef4f2ae7"
},
{
"introduced": "b182239f21c38ea57cddb41b0c03ef3eb02709f8"
},
{
"last_affected": "9146c518ece7c6b6623a9eb7a35aa174a6f1545b"
},
{
"introduced": "b87a580aa3eb23d5f05d7f619fc40a89e0f86fe5"
},
{
"last_affected": "3d77676d51dd9bf54b4ab4f9515c1b90c90de355"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.0.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.1"
},
{
"last_affected": "3.1.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2"
},
{
"last_affected": "3.2.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.3"
},
{
"last_affected": "3.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.1.8",
"v3.2.5",
"v3.3.2",
"v3.3.1",
"v3.2.4",
"v3.1.7",
"v3.1.6",
"v3.3.0",
"v3.2.3",
"v3.0.10",
"v3.0.9",
"v3.1.5",
"v3.2.2",
"v3.0.8",
"v3.2.1",
"v3.1.4",
"v3.2.0",
"v3.1.3",
"v3.0.7",
"v3.1.2",
"v3.0.6",
"v3.1.1",
"v3.0.5",
"v3.1.0",
"v3.0.4",
"v3.0.3",
"v3.0.1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15110.json"
}
}
],
"modified": "2026-10-24T10:30:49.461858607Z",
"provider": "osv",
"references": [
"https://moodle.org/mod/forum/discuss.php?d=361784"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-15110",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 436995,
"published_at": "2017-11-20T14:29:00.247+00:00"
}