Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Moodle | Moodle | 2.8.0 (including) | 2.8.0 (including) |
| Moodle | Moodle | 2.8.1 (including) | 2.8.1 (including) |
| Moodle | Moodle | 2.8.2 (including) | 2.8.2 (including) |
| Moodle | Moodle | 2.8.3 (including) | 2.8.3 (including) |
| Moodle | Moodle | 2.8.4 (including) | 2.8.4 (including) |
| Moodle | Moodle | 2.8.5 (including) | 2.8.5 (including) |
| Moodle | Ubuntu | upstream | * |