CVE-2012-0799: Infoleak
Published Jul 17, 2012
·Updated
Moodle 2.0.x before 2.0.7 and 2.1.x before 2.1.4, when an anonymous front-page forum is enabled, allows remote attackers to obtain session keys for their sessions by visiting the front page.
Affected Software
11 affected components
Moodle moodle=2.0.0
Moodle moodle=2.0.1
Moodle moodle=2.0.2
Moodle moodle=2.0.3
Moodle moodle=2.0.4
Moodle moodle=2.0.5
Moodle moodle=2.0.6
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Event History
Jul 17, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-0799?
CVE-2012-0799 has a moderate severity rating due to its potential to allow session key exposure for users.
2
How do I fix CVE-2012-0799?
To fix CVE-2012-0799, you should upgrade your Moodle installation to version 2.0.7 or 2.1.4 or later.
3
Which versions are affected by CVE-2012-0799?
CVE-2012-0799 affects Moodle versions 2.0.x prior to 2.0.7 and 2.1.x prior to 2.1.4.
4
Who can exploit CVE-2012-0799?
CVE-2012-0799 can be exploited by remote attackers who visit the front page of a Moodle site with an anonymous forum enabled.
5
What type of vulnerability is CVE-2012-0799?
CVE-2012-0799 is a session fixation vulnerability that impacts user session security.