PT-2012-4680 · Moodle · Moodle

Petr Škoda · Publicado 2012-07-23 · Atualizado 2022-05-13 · CVE-2012-3387

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.x through 2.3.0

Description The issue allows remote authenticated users to bypass intended alias restrictions in file uploads by using a client that omits the client-side check.

Recommendations For Moodle versions 2.3.x through 2.3.0, update to version 2.3.1 to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-264

CWE-287

Identificadores relacionados

CVE-2012-3387

GHSA-W66H-C2VJ-CM7F

Produtos afetados

Moodle

Referências · 14

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334 · Nota
• https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb · Nota
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-3387 · Nota de Segurança
• http://secunia.com/advisories/49890 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76954 · Nota
• http://openwall.com/lists/oss-security/2012/07/17/1 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3387 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2012-3387 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-w66h-c2vj-cm7f · Aviso do Fabricante
• https://web.archive.org/web/20121104220059/http://securityfocus.com/bid/54481 · Nota
• http://securityfocus.com/bid/54481 · Nota
• https://cve.org/CVERecord?id=CVE-2012-3387 · Nota de Segurança