CVE-2017-2642: Moodle 3.x has user fullname disclosure on the user preferences page.

Security readout for executives and security teams

This CVE describes a Moodle 3.x privacy issue where the user preferences page could disclose users' full names. The known business impact is limited to identity information exposure, not system takeover. The source bundle does not provide severity scoring, exact versions, prerequisites, or confirmed fixes. Potentially exposed environments are Moodle 3.x deployments with the affected user preferences behavior. The sources do not identify exact vulnerable patch levels, whether authentication is required, or whether specific roles are needed. Handle as a low-severity privacy exposure unless local context makes user identity disclosure sensitive. Prioritize confirmation and patch-status review over emergency response because active exploitation is not evidenced here. Mitigation focus: Review official Moodle guidance for the referenced issue and fixed releases.; Inventory Moodle 3.x instances and determine current patch status.; Limit access to Moodle user preference pages where business-appropriate..

Prepared

Jun 12, 2026, 22:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.