CVE-2012-4401: Medium severity Moodle moodle vulnerability
Published Sep 19, 2012
·Updated
Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.
Affected Software
7 affected components
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Moodle moodle=2.2.3
Moodle moodle=2.2.4
Moodle moodle=2.3.0
Moodle moodle=2.3.1
Remediation
Event History
Sep 19, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
Which Moodle deployments are affected?
Moodle 2.2.x installations before 2.2.5 and Moodle 2.3.x installations before 2.3.2 are affected. The issue applies to authenticated users who have course-editing capabilities.
2
What level of access does an attacker need?
An attacker must be able to authenticate to Moodle and have course-editing capabilities. Exploitation does not require network-local access or high attack complexity.
3
What is the remediation?
Apply the available patch by updating to Moodle 2.2.5 or later in the 2.2.x branch, or Moodle 2.3.2 or later in the 2.3.x branch.