Total vulnerabilities in the database
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
| Software | From | Fixed in |
|---|---|---|
| moodle / moodle | 2.4.1 | 2.4.1.x |
| moodle / moodle | 2.4.0 | 2.4.0.x |