CVE-2012-4400: Medium severity Moodle moodle vulnerability

Published Sep 19, 2012

Updated

repository/repositoryajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.

Affected Software

7 affected components

Moodle moodle=2.2.0

Moodle moodle=2.2.1

Moodle moodle=2.2.2

Moodle moodle=2.2.3

Moodle moodle=2.2.4

Moodle moodle=2.3.0

Moodle moodle=2.3.1

Event History

Sep 19, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

Which Moodle deployments are affected and who can exploit the issue?

Moodle 2.2.x versions before 2.2.5 and Moodle 2.3.x versions before 2.3.2 are affected. The issue is reachable remotely, but exploitation requires authentication.

What does an attacker need to do to bypass the restriction?

An authenticated user can submit -1 in the maxbytes field to bypass the intended upload-size restriction. The vulnerability affects confidentiality and availability only as not indicated by the supplied vector; the stated impact is integrity modification.

CVE-2012-4400: Medium severity Moodle moodle vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

Which Moodle deployments are affected and who can exploit the issue?

What does an attacker need to do to bypass the restriction?

Company

Resources

Contact

Frequently Asked Questions

Which Moodle deployments are affected and who can exploit the issue?

What does an attacker need to do to bypass the restriction?