GitHub Advisoryadvisory · Packagist

GHSA-xr24-jp5c-6c4v Moodle reveals absolute path in exception message

MEDIUM Published 2022-05-13 Modified 2024-01-22 Official page ↗
Aliases
CVE-2013-1831
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-01-22

Affected packages

• Packagist moodle/moodle: <= 2.1.10 (no fix yet) • Packagist moodle/moodle: >= 2.2.0, < 2.2.8 → fixed in 2.2.8 • Packagist moodle/moodle: >= 2.3.0, < 2.3.5 → fixed in 2.3.5 • Packagist moodle/moodle: >= 2.4.0, < 2.4.2 → fixed in 2.4.2

Description

lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.

Related

Alias · CVE (1)

  • CVE-2013-1831 lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References