PT-2019-6738 · Moodle · Moodle

Ralf Hilgenstock · Published 2019-11-14 · Updated 2022-04-23 · CVE-2012-1156

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.2.2 Moodle version 2.1.5 Moodle version 2.0.8

Description The issue concerns the unnecessary inclusion of users' private files in course backups. This affects the confidentiality of user data.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to exclude private files from course backups. For version 2.1.5, update to a version that excludes private files from course backups, such as version 2.1.6 or later, if available. For version 2.0.8, update to a version that excludes private files from course backups, such as version 2.0.9 or later, if available.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2012-1156

GHSA-358R-G2XW-7C83

Affected Products

Moodle

References · 18

• https://osv.dev/vulnerability/GHSA-358r-g2xw-7c83 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=198623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1156 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1156 · Patch
• https://security-tracker.debian.org/tracker/CVE-2012-1156 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/ac6dc09c261219afa0191e9f2daf030bd071d272 · Note
• https://github.com/moodle/moodle/commit/f88224624dca76e1a8a2810fd8cc04292611f91c · Note
• https://github.com/moodle/moodle/commit/37b6e7a03c77ea99fbe5224a15419e318019c570 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html · Note
• http://docs.moodle.org/dev/Moodle_2.2.2_release_notes · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html · Note
• http://docs.moodle.org/dev/Moodle_2.1.5_release_notes · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html · Note