CVE-2011-4288: Medium severity moodle vulnerability
Published Jul 16, 2012
·Updated
Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.
Affected Software
13 affected components
Moodle moodle=2.0.2
Moodle moodle=1.9.4
Moodle moodle=1.9.6
Moodle moodle=1.9.9
Moodle moodle=2.0.1
Moodle moodle=1.9.11
Moodle moodle=1.9.2
Moodle moodle=1.9.10
Moodle moodle=1.9.3
Moodle moodle=1.9.5
Moodle moodle=1.9.8
Moodle moodle=1.9.7
Moodle moodle=2.0.0
Event History
Jul 16, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4288?
CVE-2011-4288 has a moderate severity rating due to its potential to expose sensitive quiz reports.
2
How do I fix CVE-2011-4288?
To fix CVE-2011-4288, update Moodle to version 1.9.12 or later, or 2.0.3 or later.
3
Which versions of Moodle are affected by CVE-2011-4288?
CVE-2011-4288 affects Moodle versions 1.9.x before 1.9.12 and 2.0.x before 2.0.3.
4
What type of vulnerability is CVE-2011-4288?
CVE-2011-4288 is a privilege escalation vulnerability that allows unauthorized access to quiz reports.
5
Who can exploit CVE-2011-4288?
Remote authenticated users with a teacher role can exploit CVE-2011-4288 to read quiz reports of arbitrary students.