CVE-2012-5471: Moodle Allows Unauthenticated Dropbox Access
Moodle Allows Unauthenticated Dropbox Access
Other sources
The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.1.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.2.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 2.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5471?
CVE-2012-5471 has a medium severity rating as it allows unauthorized access to sensitive user data.
How do I fix CVE-2012-5471?
You can fix CVE-2012-5471 by upgrading to Moodle version 2.1.9, 2.2.6, or 2.3.3 or later.
What systems are affected by CVE-2012-5471?
CVE-2012-5471 affects Moodle versions 2.1.x prior to 2.1.9, 2.2.x prior to 2.2.6, and 2.3.x prior to 2.3.3.
What type of attack does CVE-2012-5471 describe?
CVE-2012-5471 describes an unauthorized access attack that exploits unattended workstations after logout.
Who can exploit CVE-2012-5471?
Remote authenticated users can exploit CVE-2012-5471 to access the Dropbox of other users.