CVE-2012-5480: Medium severity moodle vulnerability
Published Nov 21, 2012
·Updated
The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended restrictions on reading other participants' entries via an advanced search.
Affected Software
18 affected components
Moodle moodle=2.1.0
Moodle moodle=2.1.1
Moodle moodle=2.1.2
Moodle moodle=2.1.3
Moodle moodle=2.1.4
Moodle moodle=2.1.5
Moodle moodle=2.1.6
Moodle moodle=2.1.7
Moodle moodle=2.1.8
Moodle moodle=2.2.0
Moodle moodle=2.2.1
Moodle moodle=2.2.2
Moodle moodle=2.2.3
Moodle moodle=2.2.4
Moodle moodle=2.2.5
Moodle moodle=2.3.0
Moodle moodle=2.3.1
Moodle moodle=2.3.2
Event History
Nov 21, 2012
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-5480?
CVE-2012-5480 is classified as a medium severity vulnerability allowing unauthorized access to user data.
2
How do I fix CVE-2012-5480?
To fix CVE-2012-5480, upgrade your Moodle installation to versions 2.1.9, 2.2.6, or 2.3.3 or later.
3
What are the affected versions for CVE-2012-5480?
CVE-2012-5480 affects Moodle versions 2.1.0 to 2.1.8, 2.2.0 to 2.2.5, and 2.3.0 to 2.3.2.
4
What type of attack does CVE-2012-5480 enable?
CVE-2012-5480 enables remote attackers to bypass restrictions and read other participants' entries via advanced search.
5
Who is vulnerable to CVE-2012-5480?
Any Moodle installations running the affected versions prior to the patched releases are vulnerable to CVE-2012-5480.