CVE-2012-6102

lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37244
http://openwall.com/lists/oss-security/2013/01/21/1
https://moodle.org/mod/forum/discuss.php?d=220163	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle:2.3.0:::::::*
	cpe:2.3:a:moodle:moodle:2.3.1:::::::*
	cpe:2.3:a:moodle:moodle:2.3.2:::::::*
	cpe:2.3:a:moodle:moodle:2.3.3:::::::*

Configuration 2 (hide)

cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-01-27 22:55

Updated : 2020-12-01 14:52

NVD link : CVE-2012-6102

Mitre link : CVE-2012-6102

CVE.ORG link : CVE-2012-6102

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-6102", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-01-27T22:55:03.883", "references": [{"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37244", "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2013/01/21/1", "source": "secalert@redhat.com"}, {"url": "https://moodle.org/mod/forum/discuss.php?d=220163", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI."}, {"lang": "es", "value": "lib.php en el plugin Submission Comments en el m\u00f3dulo Assignment en Moodle v2.3.x antes de v2.3.4 y v2.4.x antes de v2.4.1 permite a atacantes remotos leer o modificar los comentarios presentaci\u00f3n (tambi\u00e9n conocido como comentarios de retroalimentaci\u00f3n) de los usuarios de su elecci\u00f3n a trav\u00e9s de un URI elaborado."}], "lastModified": "2020-12-01T14:52:24.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFD575CF-2AF2-443F-841D-F7E25FBD455A"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC2A1954-E30F-40EC-BA59-40D29573E7D6"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25EA194F-BE9D-49A8-AA35-FC7810C06643"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C3888D8-8219-4DE4-8E6C-84F58AFD3B15"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E52813-E056-4A5C-8BF5-4DD5EF5BF041"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}