GitHub Advisoryadvisory · Packagist

GHSA-72gv-qqrp-h9qg Moodle Users Can Bypass Deleted Status

MEDIUM Published 2022-05-13 Modified 2024-01-12 Official page ↗
Aliases
CVE-2012-0797
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2024-01-12

Affected packages

• Packagist moodle/moodle: >= 2.2, < 2.2.1 → fixed in 2.2.1 • Packagist moodle/moodle: >= 2.1, < 2.1.4 → fixed in 2.1.4 • Packagist moodle/moodle: >= 2.0, < 2.0.7 → fixed in 2.0.7

Description

The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token.

Related

Alias · CVE (1)

  • CVE-2012-0797 The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References