CVE-2006-4943

{"id": "CVE-2006-4943", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-09-23T00:07:00.000", "references": [{"url": "http://docs.moodle.org/en/Release_notes#Moodle_1.6.2", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter."}, {"lang": "es", "value": "course/jumpto.php en Moodle anterior a 1.6.2 no valida la llave de sesi\u00f3n (sesskey) antes de proporcionar el contenido de URIs locales de su elecci\u00f3n, que permite que atacantes remotos obtengan informaci\u00f3n sensible a trav\u00e9s del par\u00e1metro jump."}], "lastModified": "2020-12-01T14:43:40.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F20C403-413B-4474-8E4A-B6E0845F493C", "versionEndIncluding": "1.6.1"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "680CE396-5F61-409C-A152-4D1E1CB44EA3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}