CVE-2012-0800: Infoleak

Published Jul 17, 2012

Updated

The form-autocompletion functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 makes it easier for physically proximate attackers to discover passwords by reading the contents of a non-password field, as demonstrated by accessing a create-groups page with Safari on an iPad device.

Affected Software

12 affected components

Moodle moodle=2.0.0

Moodle moodle=2.0.1

Moodle moodle=2.0.2

Moodle moodle=2.0.3

Moodle moodle=2.0.4

Moodle moodle=2.0.5

Moodle moodle=2.0.6

Moodle moodle=2.1.0

Moodle moodle=2.1.1

Moodle moodle=2.1.2

Moodle moodle=2.1.3

Moodle moodle=2.2.0

Event History

Jul 17, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0800?

CVE-2012-0800 is considered a medium severity vulnerability due to its potential to expose user passwords.

How do I fix CVE-2012-0800?

To fix CVE-2012-0800, upgrade Moodle to version 2.0.7, 2.1.4, or 2.2.1 or later.

What versions of Moodle are affected by CVE-2012-0800?

CVE-2012-0800 affects Moodle versions 2.0.x prior to 2.0.7, 2.1.x prior to 2.1.4, and 2.2.x prior to 2.2.1.

What type of attack is facilitated by CVE-2012-0800?

CVE-2012-0800 facilitates physical proximity attacks that allow unauthorized access to user passwords.

Can CVE-2012-0800 impact all Moodle installations?

No, CVE-2012-0800 specifically affects older versions of Moodle and does not impact the latest ones after the mentioned updates.