CVE-2012-6099: Input Validation
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
Other sources
The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6099?
CVE-2012-6099 is classified as a high severity vulnerability due to improper pathname validation that can lead to unauthorized file access.
How do I fix CVE-2012-6099?
To mitigate CVE-2012-6099, upgrade to Moodle versions 2.1.10, 2.2.7, 2.3.4, or 2.4.1 or later.
Who is affected by CVE-2012-6099?
CVE-2012-6099 affects Moodle versions 2.1.0 through 2.1.9, 2.2.0 through 2.2.6, 2.3.0 through 2.3.3, and 2.4.0.
What types of attacks can CVE-2012-6099 enable?
CVE-2012-6099 can enable remote authenticated users to read arbitrary files on the server without proper authorization.
What components of Moodle are involved in CVE-2012-6099?
CVE-2012-6099 involves the moodle1 backup converter located in backup/converter/moodle1/lib.php.