CVE-2012-1160 : Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenroll

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php

Published 2019-11-14 17:15:13

Updated 2019-11-18 15:13:06

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2012-1160

Moodle » Moodle
Versions before (<) 2.2.2
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 17
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 16
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 15
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 51 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
2.7	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N	1.2	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html

[SECURITY] Fedora 17 Update: moodle-2.2.2-1.fc17
Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html

[SECURITY] Fedora 17 Update: moodle-2.2.2-2.fc17
Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html

[SECURITY] Fedora 16 Update: moodle-2.0.8-2.fc16
Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html

[SECURITY] Fedora 15 Update: moodle-1.9.17-1.fc15
Third Party Advisory

CVEs referencing this url
https://security-tracker.debian.org/tracker/CVE-2012-1160

CVE-2012-1160
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html

[SECURITY] Fedora 16 Update: moodle-2.0.8-1.fc16
Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1160

809223 – (CVE-2012-1155, CVE-2012-1156, CVE-2012-1157, CVE-2012-1158, CVE-2012-1159, CVE-2012-1160, CVE-2012-1161, CVE-2012-1168, CVE-2012-1169, CVE-2012-1170) CVE-2012-1155 CVE-2012-1156 CVE-2012-115
Issue Tracking;Patch;Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=198629

Moodle.org: MSA-12-0020: Forum subscription permission issue
Patch;Vendor Advisory

Jump to