CVE-2012-2367: Medium severity moodle vulnerability

Published Jul 21, 2012

Updated

Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action.

Affected Software

35 affected components

Moodle moodle=1.9.1

Moodle moodle=1.9.2

Moodle moodle=1.9.3

Moodle moodle=1.9.4

Moodle moodle=1.9.5

Moodle moodle=1.9.6

Moodle moodle=1.9.7

Moodle moodle=1.9.8

Moodle moodle=1.9.9

Moodle moodle=1.9.10

Moodle moodle=1.9.11

Moodle moodle=1.9.12

Moodle moodle=1.9.13

Moodle moodle=1.9.14

Moodle moodle=1.9.15

Moodle moodle=1.9.16

Moodle moodle=1.9.17

Moodle moodle=2.0.0

Moodle moodle=2.0.1

Moodle moodle=2.0.2

Moodle moodle=2.0.3

Moodle moodle=2.0.4

Moodle moodle=2.0.5

Moodle moodle=2.0.6

Moodle moodle=2.0.7

Moodle moodle=2.0.8

Moodle moodle=2.1.0

Moodle moodle=2.1.1

Moodle moodle=2.1.2

Moodle moodle=2.1.3

Moodle moodle=2.1.4

Moodle moodle=2.1.5

Moodle moodle=2.2.0

Moodle moodle=2.2.1

Moodle moodle=2.2.2

Event History

Jul 21, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-2367?

CVE-2012-2367 has a severity rating that indicates potential risk to user data and unauthorized calendar entry manipulation.

How do I fix CVE-2012-2367?

To fix CVE-2012-2367, upgrade your Moodle installation to versions 1.9.18, 2.0.9, 2.1.6, or 2.2.3 or later.

Which versions of Moodle are affected by CVE-2012-2367?

CVE-2012-2367 affects Moodle versions 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3.

Who can exploit CVE-2012-2367?

Remote authenticated users can exploit CVE-2012-2367 to bypass calendar entry permissions.

What is the impact of CVE-2012-2367 on Moodle systems?

The impact of CVE-2012-2367 allows unauthorized calendar entry creation, potentially leading to data integrity issues.