PT-2008-4733 · Moodle · Moodle

Richard Brain · Publicado 2008-07-25 · Atualizado 2018-10-11 · CVE-2008-3327

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle version 1.6.5

Description The issue allows remote attackers to obtain sensitive information via a direct request to certain PHP files, specifically "blog/blogpage.php" and "course/report/stats/report.php", when display errors is enabled. This reveals the installation path in an error message.

Recommendations For Moodle version 1.6.5, consider disabling the display errors setting to prevent sensitive information disclosure. Additionally, restrict access to the "blog/blogpage.php" and "course/report/stats/report.php" files until a more permanent solution is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3327

Produtos afetados

Moodle

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/44032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3327 · Nota de Segurança
• http://procheckup.com/Vulnerability_PR08-15.php · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3327 · Nota
• http://securityfocus.com/archive/1/494657/100/0/threaded · Nota
• http://moodle.org/mod/forum/discuss.php?d=101403 · Nota