GitHub Advisoryadvisory · Packagist

GHSA-pgp5-rcwp-qvfg Moodle includes the WebDAV password in the configuration form

MEDIUM Published 2022-05-13 Modified 2024-01-22 Official page ↗
Aliases
CVE-2013-1832
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-01-22

Affected packages

• Packagist moodle/moodle: >= 2.0.0, <= 2.1.10 (no fix yet) • Packagist moodle/moodle: >= 2.2.0, < 2.2.8 → fixed in 2.2.8 • Packagist moodle/moodle: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • Packagist moodle/moodle: >= 2.4.0, < 2.4.2 → fixed in 2.4.2

Description

repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.

Related

Alias · CVE (1)

  • CVE-2013-1832 repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References