PT-2019-6738 · Moodle · Moodle

Ralf Hilgenstock · Publicado 2019-11-14 · Atualizado 2022-04-23 · CVE-2012-1156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.2.2 Moodle version 2.1.5 Moodle version 2.0.8

Description The issue concerns the unnecessary inclusion of users' private files in course backups. This affects the confidentiality of user data.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to exclude private files from course backups. For version 2.1.5, update to a version that excludes private files from course backups, such as version 2.1.6 or later, if available. For version 2.0.8, update to a version that excludes private files from course backups, such as version 2.0.9 or later, if available.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2012-1156

GHSA-358R-G2XW-7C83

Produtos afetados

Moodle

Referências · 18

• https://github.com/moodle/moodle · Nota
• https://github.com/moodle/moodle/commit/ac6dc09c261219afa0191e9f2daf030bd071d272 · Nota
• https://github.com/moodle/moodle/commit/f88224624dca76e1a8a2810fd8cc04292611f91c · Nota
• https://github.com/moodle/moodle/commit/37b6e7a03c77ea99fbe5224a15419e318019c570 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html · Nota
• https://osv.dev/vulnerability/GHSA-358r-g2xw-7c83 · Aviso do Fabricante
• https://moodle.org/mod/forum/discuss.php?d=198623 · Aviso do Fabricante
• http://docs.moodle.org/dev/Moodle_2.2.2_release_notes · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1156 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1156 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html · Nota
• http://docs.moodle.org/dev/Moodle_2.1.5_release_notes · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html · Nota
• https://access.redhat.com/security/cve/cve-2012-1156 · Nota