PT-2012-4680 · Moodle · Moodle

Petr Škoda · Published 2012-07-23 · Updated 2022-05-13 · CVE-2012-3387

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.x through 2.3.0

Description The issue allows remote authenticated users to bypass intended alias restrictions in file uploads by using a client that omits the client-side check.

Recommendations For Moodle versions 2.3.x through 2.3.0, update to version 2.3.1 to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-264

CWE-287

Related Identifiers

CVE-2012-3387

GHSA-W66H-C2VJ-CM7F

Affected Products

Moodle

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2012-3387 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3387 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-3387 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w66h-c2vj-cm7f · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3387 · Security Note
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334 · Note
• https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948 · Note
• http://secunia.com/advisories/49890 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76954 · Note
• http://openwall.com/lists/oss-security/2012/07/17/1 · Note
• https://web.archive.org/web/20121104220059/http://securityfocus.com/bid/54481 · Note
• http://securityfocus.com/bid/54481 · Note