CVE-2012-3391: Medium severity Moodle moodle vulnerability
mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a forum.
Affected Software
Event History
Frequently Asked Questions
Which Moodle deployments are affected?
Moodle installations in the 2.1.x branch before 2.1.7 and the 2.2.x branch before 2.2.4 are affected. The issue applies to Q&A forums where posting before reading is intended to restrict access to other posts.
What access does an attacker need to exploit this issue?
An attacker needs to be remotely authenticated to Moodle and have the student role. They can then read the RSS feed for a Q&A forum to bypass the intended post-before-read restriction.
How can I determine whether this issue is affecting my site?
Review whether student-role users can access RSS feeds for Q&A forums configured to require posting before reading. Access to forum content through such a feed indicates the restriction can be bypassed on affected versions.