#VU43315 Permissions, Privileges, and Access Controls in Moodle - CVE-2012-5480

Vulnerability identifier: #VU43315

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2012-5480

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Moodle
Web applications / Other software

Vendor: moodle.org

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended restrictions on reading other participants' entries via an advanced search.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Moodle: 2.1 - 2.1.8, 2.2 - 2.2.5, 2.3 - 2.3.2

---

External links
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35558
https://openwall.com/lists/oss-security/2012/11/19/1
https://www.securityfocus.com/bid/56505
https://moodle.org/mod/forum/discuss.php?d=216160

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.