PT-2013-1896 · Moodle · Moodle

David Obrien · Publicado 2013-01-27 · Atualizado 2020-12-01 · CVE-2012-6106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions 2.4.0

Description The issue is related to the Manage Subscriptions implementation in Moodle, where a capability check is omitted. This allows remote authenticated users with the student role to remove course-level calendar subscriptions by sending an iCalendar object.

Recommendations For Moodle version 2.4.0, update to version 2.4.1 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-6106

Produtos afetados

Moodle

Referências · 5

• http://openwall.com/lists/oss-security/2013/01/21/1 · Nota
• https://moodle.org/mod/forum/discuss.php?d=220167 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-6106 · Nota de Segurança
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37106 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6106 · Nota