CVE-2012-6102

2013-01-2722:55:03

CWE-264

redhat

web.nvd.nist.gov

cve-2012-6102

nvd

moodle

remote code execution

security vulnerability

uri crafted attack

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.003

Percentile

69.2%

JSON

lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.

Affected configurations

Nvd

Node

moodlemoodleMatch2.3.0

moodlemoodleMatch2.3.1

moodlemoodleMatch2.3.2

moodlemoodleMatch2.3.3

Node

moodlemoodleMatch2.4.0

VendorProductVersionCPE
moodlemoodle2.3.0cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*
moodlemoodle2.3.1cpe:2.3:a:moodle:moodle:2.3.1:*:*:*:*:*:*:*
moodlemoodle2.3.2cpe:2.3:a:moodle:moodle:2.3.2:*:*:*:*:*:*:*
moodlemoodle2.3.3cpe:2.3:a:moodle:moodle:2.3.3:*:*:*:*:*:*:*
moodlemoodle2.4.0cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	2.3.0	cpe:2.3:a:moodle:moodle:2.3.0:::::::*
moodle	moodle	2.3.1	cpe:2.3:a:moodle:moodle:2.3.1:::::::*
moodle	moodle	2.3.2	cpe:2.3:a:moodle:moodle:2.3.2:::::::*
moodle	moodle	2.3.3	cpe:2.3:a:moodle:moodle:2.3.3:::::::*
moodle	moodle	2.4.0	cpe:2.3:a:moodle:moodle:2.4.0:::::::*