PT-2013-1896 · Moodle · Moodle

David Obrien · Published 2013-01-27 · Updated 2020-12-01 · CVE-2012-6106

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Moodle versions 2.4.0

Description The issue is related to the Manage Subscriptions implementation in Moodle, where a capability check is omitted. This allows remote authenticated users with the student role to remove course-level calendar subscriptions by sending an iCalendar object.

Recommendations For Moodle version 2.4.0, update to version 2.4.1 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-6106

Affected Products

Moodle

References · 5

• https://moodle.org/mod/forum/discuss.php?d=220167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6106 · Security Note
• http://openwall.com/lists/oss-security/2013/01/21/1 · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37106 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6106 · Note