I am sorry for my lack of knowledge in this matter.

My university (basically an international university in the UK that has students from different countries) has a website which requires the students to login before they can access their examination results. These results also include their Name and Address.

But by inspecting the network transaction, I found out that it went to a page that directly takes student registration number in the URL and displays the examination result related to that. This page can be accessed without logging in to the student account and without any hassle, it gave me the examination result that exposed the student name and address. I tried multiple registration numbers similar to mine and all were processed easily.

Another problem is that these registration numbers are in fixed length, only contain numbers and are in ascending order. So for example if a valid registration number is 000001 then the next one would be 000002 and so on.

So in my opinion an attacker can easily create an automated program that could generate these registration numbers, randomly or in order, and get the names and addresses of hundreds of students.

My questions are: 


Is it universally approved practice for universities to expose the names and addresses of students?
Is it universally approved practice for universities that strong security related to name and address is not important?
Is it a severe attack and do I have to report it to them? Or can it simply be ignored?


Update:

I received the reply from the university and they have now fixed it. Thanks to all of you.


  I am sorry for my lack of knowledge in this matter.


You shouldn't be.


  Is it universally approved practice for universities to expose the name and addresses of students?


As pointed out in comments, it depends on your local laws and regulations. You should certainly check it once. But the way you describe the application(changing the URL to get the details, including the result), it sounds like a bug, which should certainly be reported.


  Is it universally approved practice for universities that strong security related to name and address is not important?


No, be it a university or a big MNC or a small enterprise, or your own personal account, security is ALWAYS important.


  Is it a severe attack and do I have to report it to them? Or it can be simply ignored?


Yes, you have to report it to the university, as soon as possible. It should not be ignored.

EDIT: As pointed out in comments, there are some universities which do allow students' addresses to be made public.
