CVE-2017-7531: In Moodle 3.3, the course overview block reveals activities in hidden courses.

Security readout for executives and security teams

This is an information disclosure issue in Moodle 3.3. The course overview block can reveal activities from courses that are meant to be hidden. The main business risk is unintended exposure of course structure, activity names, or sensitive operational timing to users who should not see them. Likely exposure is limited to Moodle 3.3 deployments using the course overview block with hidden courses containing activities users should not see. The source bundle does not define wider version ranges or deployment prerequisites. Prioritize remediation where Moodle hosts confidential training, compliance, HR, customer, or embargoed course material. If hidden courses are not used or contain no sensitive activities, urgency is lower but still worth closing during normal maintenance. Mitigation focus: Identify Moodle instances and confirm whether any run version 3.3.; Review Moodle guidance linked from the CVE references for the appropriate fix.; Restrict visibility of sensitive hidden-course activity metadata until remediated..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.