CVE-2012-5473: The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allow...

Security readout for executives and security teams

This Moodle flaw could let a logged-in user view Database activity entries belonging to users in another group. It is a confidentiality issue, not a full system compromise in the provided sources. The main business risk is unintended disclosure of course or participant data where Moodle groups were meant to isolate access. Exposure is limited to Moodle deployments running the affected 2.1, 2.2, or 2.3 branches and using Database activities with group separation expectations. The attacker must be authenticated, so internet-facing login access raises concern but unauthenticated public compromise is not supported by the sources. Treat this as a targeted privacy and data-segregation risk for legacy Moodle environments. It is most urgent where Moodle stores regulated, student, or customer information and relies on groups to restrict visibility. Mitigation focus: Upgrade affected Moodle 2.1.x, 2.2.x, or 2.3.x systems to the fixed versions or later.; Review Moodle’s advisory and MDL-34448 change references for version-specific remediation details.; Identify courses using Database activities where group separation protects sensitive entries..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.