CVE-2012-4403: Infoleak

Published Sep 19, 2012

Updated

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.

Affected Software

2 affected components

Moodle moodle=2.3.0

Moodle moodle=2.3.1

Remediation

Patch Available

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35168

Event History

Sep 19, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4403?

CVE-2012-4403 has been classified with a medium severity due to its potential for exposing sensitive installation path information.

How do I fix CVE-2012-4403?

To mitigate CVE-2012-4403, upgrade Moodle to version 2.3.2 or later where the vulnerability has been addressed.

What systems are affected by CVE-2012-4403?

CVE-2012-4403 affects Moodle versions 2.3.0 and 2.3.1 prior to 2.3.2.

What type of vulnerability is CVE-2012-4403?

CVE-2012-4403 is a server-side error handling vulnerability that can lead to information disclosure.

Can this vulnerability be exploited remotely in CVE-2012-4403?

Yes, CVE-2012-4403 can be exploited remotely by attackers sending requests for nonexistent resources.