Moodle does not enforce capability requirements for reading blog comments
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2013-2082US | medium5.0 | — | ||
Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attac… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245WEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.htmlWEB
- http://openwall.com/lists/oss-security/2013/05/21/1WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/28772fb9e7e6be01b765fb721af16901bb47e417WEB
- https://github.com/moodle/moodle/commit/5fde58a59335bc3109a9eaac4a15d1e9217541c3WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan