VYPR
← All advisories
Moderate severityNVD Advisory· Published May 27, 2014· Updated Jun 17, 2026

CVE-2014-0217

CVE-2014-0217

Description

enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 2.6.0, < 2.6.32.6.3

Affected products

4
  • Moodle/Moodle3 versions
    cpe:2.3:a:moodle:moodle:2.6.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:moodle:moodle:2.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:moodle:moodle:2.6.2:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:composer/moodle/moodle
    Range: >= 2.6.0, < 2.6.3

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.