Lucene search

GitHub Advisory DatabaseGHSA-358R-G2XW-7C83

HistoryApr 23, 2022 - 12:40 a.m.

Moodle backs up private files

2022-04-2300:40:10

CWE-532

GitHub Advisory Database

github.com

moodle

private files

backups

software

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

67.8%

JSON

Moodle before 2.2.2, 2.1.5, and 2.0.8 had users’ private files included in course backups unnecessarily.

Affected configurations

Vulners

Node

moodlemoodleRange≤2.0.7

moodlemoodleRange≤2.1.4

moodlemoodleRange≤2.2.1

VendorProductVersionCPE
moodlemoodle*cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
moodle	moodle	*	cpe:2.3:a:moodle:moodle::::::::

References

docs.moodle.org/dev/Moodle_2.0.8_release_notes

docs.moodle.org/dev/Moodle_2.1.5_release_notes

docs.moodle.org/dev/Moodle_2.2.2_release_notes

lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html

lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html

lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html

lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html

lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html

access.redhat.com/security/cve/cve-2012-1156

bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1156

github.com/advisories/GHSA-358r-g2xw-7c83

github.com/moodle/moodle/commit/37b6e7a03c77ea99fbe5224a15419e318019c570

github.com/moodle/moodle/commit/ac6dc09c261219afa0191e9f2daf030bd071d272

github.com/moodle/moodle/commit/f88224624dca76e1a8a2810fd8cc04292611f91c

moodle.org/mod/forum/discuss.php?d=198623

nvd.nist.gov/vuln/detail/CVE-2012-1156

security-tracker.debian.org/tracker/CVE-2012-1156

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

67.8%

JSON

Related for GHSA-358R-G2XW-7C83