GitHub Advisoryadvisory · Packagist

GHSA-jcrj-gmr6-p5j8 Moodle Allows Modification of Constants

MEDIUM Published 2022-05-13 Modified 2024-01-17 Official page ↗
Aliases
CVE-2011-4301
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-471
Reviewed
2024-01-17

Affected packages

• Packagist moodle/moodle: < 1.9.14 → fixed in 1.9.14 • Packagist moodle/moodle: >= 2.0, < 2.0.5 → fixed in 2.0.5 • Packagist moodle/moodle: >= 2.1, < 2.1.2 → fixed in 2.1.2

Description

The `MoodleQuickForm` class in the Forms Library in `lib/formslib.php` in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API `setConstant` operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.

Related

Alias · CVE (1)

  • CVE-2011-4301 The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before… vulnerability

Weakness · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References