CVE-2012-6101: Input Validation

Published Jan 27, 2013

Updated

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to (1) backup/backupfilesedit.php, (2) comment/commentpost.php, (3) course/switchrole.php, (4) mod/wiki/filesedit.php, (5) tag/coursetagsadd.php, or (6) user/files.php.

Affected Software

12 affected components

Moodle moodle=2.2.0

Moodle moodle=2.2.1

Moodle moodle=2.2.2

Moodle moodle=2.2.3

Moodle moodle=2.2.4

Moodle moodle=2.2.5

Moodle moodle=2.2.6

Moodle moodle=2.3.0

Moodle moodle=2.3.1

Moodle moodle=2.3.2

Moodle moodle=2.3.3

Moodle moodle=2.4.0

Event History

Jan 27, 2013

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-6101?

CVE-2012-6101 is classified as a medium severity vulnerability due to its ability to facilitate phishing attacks.

How do I fix CVE-2012-6101?

To fix CVE-2012-6101, update Moodle to version 2.2.7, 2.3.4, or 2.4.1 or later.

What are the main affected versions in CVE-2012-6101?

CVE-2012-6101 affects Moodle versions 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1.

How does CVE-2012-6101 exploit users?

CVE-2012-6101 exploits users by allowing attackers to redirect them to arbitrary websites, potentially conducting phishing attacks.

What components are involved in CVE-2012-6101?

The components involved in CVE-2012-6101 include backup/backupfilesedit.php and comment/comment_post.php.