CVE-2012-0797: Moodle Users Can Bypass Deleted Status
Moodle Users Can Bypass Deleted Status
Other sources
The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.0.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.1.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0797?
CVE-2012-0797 is classified as a high severity vulnerability due to the potential for unauthorized access to web services.
How do I fix CVE-2012-0797?
To fix CVE-2012-0797, upgrade Moodle to version 2.0.7 or later, 2.1.4 or later, or 2.2.1 or later.
Which versions of Moodle are affected by CVE-2012-0797?
Moodle versions 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 are affected by CVE-2012-0797.
Is CVE-2012-0797 a remote exploitation vulnerability?
Yes, CVE-2012-0797 allows remote authenticated users to exploit the vulnerability via a token.
What can happen if CVE-2012-0797 is not patched?
If CVE-2012-0797 is not patched, attackers may be able to bypass account deletions and access web services.