CVE-2012-4407: Infoleak
Published Sep 19, 2012
·Updated
lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.
Affected Software
15 affected components
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Moodle moodle=2.1.4
Moodle moodle=2.1.5
Moodle moodle=2.1.6
Moodle moodle=2.1.7
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Moodle moodle=2.2.3
Moodle moodle=2.2.4
Moodle moodle=2.3.0
Moodle moodle=2.3.1
Remediation
Event History
Sep 19, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4407?
CVE-2012-4407 has a medium severity rating as it allows unauthorized access to sensitive information.
2
How do I fix CVE-2012-4407?
To fix CVE-2012-4407, upgrade Moodle to version 2.1.8, 2.2.5, or 2.3.2 or later.
3
What systems are affected by CVE-2012-4407?
CVE-2012-4407 affects Moodle versions 2.1.0 through 2.1.7, 2.2.0 through 2.2.4, and 2.3.0 through 2.3.1.
4
What type of vulnerability is CVE-2012-4407?
CVE-2012-4407 is classified as an information disclosure vulnerability due to improper access controls.
5
Can CVE-2012-4407 lead to data breaches?
Yes, CVE-2012-4407 can potentially lead to data breaches by exposing non-public files.