CVE-2012-4401: Medium severity Moodle moodle vulnerability

Published Sep 19, 2012

Updated

Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.

Affected Software

7 affected components

Moodle moodle=2.2.0

Moodle moodle=2.2.1

Moodle moodle=2.2.2

Moodle moodle=2.2.3

Moodle moodle=2.2.4

Moodle moodle=2.3.0

Moodle moodle=2.3.1

Remediation

Patch Available

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28207

Event History

Sep 19, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

Which Moodle deployments are affected?

Moodle 2.2.x installations before 2.2.5 and Moodle 2.3.x installations before 2.3.2 are affected. The issue applies to authenticated users who have course-editing capabilities.

What level of access does an attacker need?

An attacker must be able to authenticate to Moodle and have course-editing capabilities. Exploitation does not require network-local access or high attack complexity.

What is the remediation?

Apply the available patch by updating to Moodle 2.2.5 or later in the 2.2.x branch, or Moodle 2.3.2 or later in the 2.3.x branch.

CVE-2012-4401: Medium severity Moodle moodle vulnerability

Affected Software

Remediation

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

Which Moodle deployments are affected?

What level of access does an attacker need?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which Moodle deployments are affected?

What level of access does an attacker need?

What is the remediation?