PT-2012-1849 · Moodle · Moodle

Published 2012-07-11 · Updated 2023-02-13 · CVE-2011-4301

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.13 Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1

Description The issue allows remote attackers to submit unexpected form content by modifying the values of constant fields. This is due to the MoodleQuickForm class in the Forms Library not recognizing Forms API setConstant operations.

Recommendations For Moodle versions 1.9.x through 1.9.13, update to version 1.9.14 or later. For Moodle versions 2.0.x through 2.0.4, update to version 2.0.5 or later. For Moodle versions 2.1.x through 2.1.1, update to version 2.1.2 or later.

Fix

Weakness Enumeration

CWE-471

Related Identifiers

CVE-2011-4301

DSA-2338-1

GHSA-JCRJ-GMR6-P5J8

Affected Products

Moodle

References · 11

• https://osv.dev/vulnerability/GHSA-jcrj-gmr6-p5j8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4301 · Security Note
• http://moodle.org/mod/forum/discuss.php?d=188313 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/2a44c5192c875c4f4b4e813d7227b19d8fda86ba · Note
• https://github.com/moodle/moodle/commit/f1f70bd4dde6cd1ea4bdb8ab28fa3d36a53b89d8 · Note
• https://github.com/moodle/moodle/commit/1f52e72526c305989eadc702b5299edb2a50ac3c · Note
• https://github.com/moodle/moodle/commit/a6f18c98f43b6fc6b8b7c4e96af41cb4a626e1b8 · Note
• http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=f1f70bd4dde6cd1ea4bdb8ab28fa3d36a53b89d8 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=747444 · Note
• http://git.moodle.org/gw?p=moodle.git;a=commit;h=f1f70bd4dde6cd1ea4bdb8ab28fa3d36a53b89d8 · Note