Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class
The MoodleQuickForm class in `lib/formslib.php` in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2013-2083US | medium5.0 | — | ||
The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-ele… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38885WEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.htmlWEB
- http://openwall.com/lists/oss-security/2013/05/21/1WEB
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/3c0ba94e879702b3c2f20d4cb4f9120a0bfdd9fcWEB
- https://github.com/moodle/moodle/commit/8a9c3f4951e05eea80775d8c82d00a64434376c7WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan