GitHub Advisoryadvisory · Packagist

GHSA-x3x8-fjw6-hccx Moodle does not consider "don't send" attributes during hub registration

MEDIUM Published 2022-05-13 Modified 2024-01-23 Official page ↗
Aliases
CVE-2013-2081
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-284
Reviewed
2024-01-23

Affected packages

• Packagist moodle/moodle: < 2.2.10 → fixed in 2.2.10 • Packagist moodle/moodle: >= 2.3.0, < 2.3.7 → fixed in 2.3.7 • Packagist moodle/moodle: >= 2.4.0, < 2.4.4 → fixed in 2.4.4

Description

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.

Related

Alias · CVE (1)

  • CVE-2013-2081 Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References