GitHub Advisoryadvisory · Packagist
GHSA-4w8m-96v9-2c86 Moodle CRLF Injection Vulnerability in Calendar Component
MEDIUM
Official page ↗
- Aliases
- CVE-2011-4203
- Ecosystem
- Packagist
- Packages
- moodle/moodle
- Severity
- Moderate
- Weaknesses
- CWE-113, CWE-93
- Reviewed
- 2024-01-17
Affected packages
• Packagist moodle/moodle: < 1.9.15 → fixed in 1.9.15
• Packagist moodle/moodle: >= 2.0, < 2.0.6 → fixed in 2.0.6
• Packagist moodle/moodle: >= 2.1, < 2.1.3 → fixed in 2.1.3
Description
CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
Related
Alias · CVE (1)
- CVE-2011-4203 CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2011-4203 advisory
- https://github.com/moodle/moodle/commit/581e8dba387f090d89382115fd850d8b44351526 web
- https://github.com/moodle/moodle/commit/ae7cc577b7115a7ad7a68dc4986aca9e2bda2cf5 web
- https://github.com/moodle/moodle/commit/bc577df6a974606fcb0882b090b00ea5a4e10cf6 web
- https://github.com/moodle/moodle/commit/e311b14364719b0f7851149ee51c1a4ec732635e web
- https://github.com/moodle/moodle package
- https://moodle.org/mod/forum/discuss.php?d=191754 web
- http://penturalabs.wordpress.com/2011/12/13/advisory-crlf-injection-vulnerability-in-moodle web