GitHub Advisoryadvisory · Packagist

GHSA-wxvp-8q8h-r6rr Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory

MEDIUM Published 2022-05-13 Modified 2024-01-17 Official page ↗
Aliases
CVE-2011-4293
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-379
Reviewed
2024-01-17

Affected packages

• Packagist moodle/moodle: >= 2.0, < 2.0.4 → fixed in 2.0.4 • Packagist moodle/moodle: >= 2.1, < 2.1.1 → fixed in 2.1.1

Description

The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.

Related

Alias · CVE (1)

  • CVE-2011-4293 The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and… vulnerability

Weakness · CWE (1)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness

References