CVE-2012-3387
CVE-2012-3387
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.
EPSS 1.1% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
moodle/moodle Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.3, < 2.3.1
Update to 2.3.1
Original sources
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948
- http://secunia.com/advisories/49890
- http://openwall.com/lists/oss-security/2012/07/17/1
- http://www.securityfocus.com/bid/54481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76954
- https://nvd.nist.gov/vuln/detail/CVE-2012-3387