{"id":"CVE-2018-10890","details":"A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.","aliases":["GHSA-5w4h-xrr5-7273"],"modified":"2026-07-08T14:59:23.491744Z","published":"2018-07-10T18:29:00.280Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/104738"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890"},{"type":"FIX","url":"https://moodle.org/mod/forum/discuss.php?d=373370"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/moodle/moodle","events":[{"introduced":"268abfacc54c4cbf9722c1502569b311c7caefff"},{"fixed":"b19d180a869d69c66d3f6c72c35ddc9c8dafb935"},{"introduced":"b87a580aa3eb23d5f05d7f619fc40a89e0f86fe5"},{"fixed":"027b757f20c8e50d6fec2ef6f1ff2d85075690fc"},{"introduced":"665c3ac59c35b7387a4fc70b8ac6600ce9ffeb87"},{"fixed":"5ebb6eb15c250e175e2079bce5bb1c74eae29477"},{"introduced":"46574904afd39578fa4146bf1fc5c401ac680aa6"},{"fixed":"5b78584fdbda65ac516f39f9e66f9376a793de92"}],"database_specific":{"cpe":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.1.0"},{"fixed":"3.1.13"},{"introduced":"3.3.0"},{"fixed":"3.3.7"},{"introduced":"3.4.0"},{"fixed":"3.4.4"},{"introduced":"3.5.0"},{"fixed":"3.5.1"}],"source":"CPE_RANGE"}}],"versions":["v3.4.3","v3.5.0","v3.3.6","v3.1.12","v3.1.11","v3.4.2","v3.3.5","v3.4.1","v3.3.4","v3.1.10","v3.4.0","v3.1.9","v3.3.3","v3.1.8","v3.3.2","v3.3.1","v3.1.7","v3.1.6","v3.3.0","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10890.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}