CVE-2012-2356: Medium severity moodle vulnerability
Published Jul 21, 2012
·Updated
The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action.
Affected Software
11 affected componentsFixes available
composer/moodle/moodle>=2.2<2.2.3
2.2.3
composer/moodle/moodle>=2.1<2.1.6
2.1.6
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Moodle moodle=2.1.4
Moodle moodle=2.1.5
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Event History
Jul 21, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
May 13, 2022
Advisory Published
via GitHub·01:13 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-2356?
CVE-2012-2356 is classified as a medium severity vulnerability.
2
How do I fix CVE-2012-2356?
To fix CVE-2012-2356, upgrade Moodle to version 2.1.6 or later for the 2.1.x series and to version 2.2.3 or later for the 2.2.x series.
3
What impact does CVE-2012-2356 have on Moodle?
CVE-2012-2356 allows remote authenticated users to bypass capability requirements and save questions in the question bank.
4
Which versions of Moodle are affected by CVE-2012-2356?
Moodle versions 2.1.x before 2.1.6 and 2.2.x before 2.2.3 are affected by CVE-2012-2356.
5
Is it possible to exploit CVE-2012-2356 without being authenticated?
No, exploitation of CVE-2012-2356 requires the attacker to be a remote authenticated user.