CVE-2010-1617

Vulnerability

In Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, the file user/view.php does not properly validate a user's role when displaying the course profile page. This allows remote authenticated users who are enrolled in a course to view the full names of other users in that course, bypassing intended role-based access controls [1].

Exploitation

An attacker must have a valid authenticated session on a vulnerable Moodle instance and be enrolled in a course. By navigating to the course profile page (e.g., /user/view.php with appropriate parameters for a target user in the same course), the attacker can retrieve the full name of that user. No special privileges or additional steps beyond normal web access are required [1].

Impact

An authenticated user can obtain full names of other users in the same course, resulting in unauthorized disclosure of personally identifiable information. This information disclosure could be used for social engineering or to map user accounts. The vulnerability does not provide access to roles, passwords, or other sensitive data, but it violates user privacy expectations [1].

Mitigation

The vulnerability is fixed in Moodle 1.8.12 and 1.9.8, both released in 2010. Administrators should upgrade to these versions or later. For sites still running older unsupported versions, no workaround is available, and upgrading is strongly recommended. This CVE is not currently listed in CISA's Known Exploited Vulnerabilities catalog [1].