PT-2008-4733 · Moodle · Moodle

Richard Brain · Published 2008-07-25 · Updated 2018-10-11 · CVE-2008-3327

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle version 1.6.5

Description The issue allows remote attackers to obtain sensitive information via a direct request to certain PHP files, specifically "blog/blogpage.php" and "course/report/stats/report.php", when display errors is enabled. This reveals the installation path in an error message.

Recommendations For Moodle version 1.6.5, consider disabling the display errors setting to prevent sensitive information disclosure. Additionally, restrict access to the "blog/blogpage.php" and "course/report/stats/report.php" files until a more permanent solution is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3327

Affected Products

Moodle

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-3327 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44032 · Note
• http://procheckup.com/Vulnerability_PR08-15.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3327 · Note
• http://securityfocus.com/archive/1/494657/100/0/threaded · Note
• http://moodle.org/mod/forum/discuss.php?d=101403 · Note