CVE-2012-6087: Input Validation
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPTSSLVERIFYHOST value.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6087?
CVE-2012-6087 is classified as a medium severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2012-6087?
To fix CVE-2012-6087, update your Moodle installation to versions 2.3.9, 2.4.6, or 2.5.2 or later.
Which versions of Moodle are affected by CVE-2012-6087?
CVE-2012-6087 affects Moodle versions prior to 2.3.9, 2.4.6, and 2.5.2.
What can happen if I don’t address CVE-2012-6087?
If CVE-2012-6087 is not addressed, it may allow an attacker to intercept and manipulate data between the user and the server.
Is there a specific patch for CVE-2012-6087?
There is no specific patch for CVE-2012-6087; the vulnerability is resolved through upgrading to a patched version of Moodle.