PT-2012-1827

CVE-2011-4279

Published

2012-07-16

Updated

2022-05-13

Description by

CVSS 4.0

6.6

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0.x through 2.0.1

Description The issue makes it easier for remote attackers to obtain potentially sensitive information via vectors involving the use of a search engine. This is because the forceloginforprofiles setting is not used for course-profiles access control.

Recommendations For Moodle versions 2.0.x through 2.0.1, update to version 2.0.2 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-284: Improper Access Control

Related identifiers

CVE-2011-4279