GitHub Advisoryadvisory · Packagist

GHSA-9p54-pc88-36c4 Moodle does not properly restrict access to category and course data

MEDIUM Published 2022-05-13 Modified 2024-01-17 Official page ↗
Aliases
CVE-2011-4300
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2024-01-17

Affected packages

• Packagist moodle/moodle: >= 2.1, < 2.1.2 → fixed in 2.1.2 • Packagist moodle/moodle: >= 2.0.0, < 2.0.5 → fixed in 2.0.5

Description

The `file_browser` component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.

Related

Alias · CVE (1)

  • CVE-2011-4300 The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References