CVE-2011-4283: Moodle allows remote attackers to obtain sensitive information
Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.
Other sources
Moodle allows remote attackers to obtain sensitive information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 1.9.11
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4283?
CVE-2011-4283 has a medium severity rating due to its potential to expose sensitive data.
How do I fix CVE-2011-4283?
To fix CVE-2011-4283, you should upgrade your Moodle installation to version 1.9.11 or 2.0.2 or later.
What versions of Moodle are affected by CVE-2011-4283?
CVE-2011-4283 affects Moodle versions 1.9.x before 1.9.11 and 2.0.x before 2.0.2.
What type of information can be exposed by CVE-2011-4283?
CVE-2011-4283 allows remote attackers to obtain sensitive information by accessing the imsenterprise-enrol.xml file.
Is there a workaround for CVE-2011-4283?
There are no known workarounds for CVE-2011-4283 other than applying the recommended updates.