GitHub Advisoryadvisory · Packagist

GHSA-w66h-c2vj-cm7f Moodle Authentication Bypass in File Upload

MEDIUM Published 2022-05-13 Modified 2024-01-11 Official page ↗
Aliases
CVE-2012-3387
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-287
Reviewed
2024-01-11

Affected packages

• Packagist moodle/moodle: >= 2.3, < 2.3.1 → fixed in 2.3.1

Description

Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.

Related

Alias · CVE (1)

  • CVE-2012-3387 Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References