CVE-2012-1168 : Moodle before 2.2.2 has a password and web services issue where when the user pr

Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.

Published 2019-11-14 16:15:14

Updated 2019-11-22 18:32:38

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2012-1168

Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Moodle » Moodle
Versions before (<) 2.2.2
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 17
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 16
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 15
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L	3.9	4.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: Low

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html

[SECURITY] Fedora 17 Update: moodle-2.2.2-1.fc17
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html

[SECURITY] Fedora 17 Update: moodle-2.2.2-2.fc17
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html

[SECURITY] Fedora 16 Update: moodle-2.0.8-2.fc16
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html

[SECURITY] Fedora 15 Update: moodle-1.9.17-1.fc15
Mailing List;Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1168

809223 – (CVE-2012-1155, CVE-2012-1156, CVE-2012-1157, CVE-2012-1158, CVE-2012-1159, CVE-2012-1160, CVE-2012-1161, CVE-2012-1168, CVE-2012-1169, CVE-2012-1170) CVE-2012-1155 CVE-2012-1156 CVE-2012-115
Issue Tracking;Patch;Third Party Advisory
https://moodle.org/mod/forum/discuss.php?d=198622

Moodle.org: MSA-12-0014: Password and Web services issue
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html

[SECURITY] Fedora 16 Update: moodle-2.0.8-1.fc16
Mailing List;Third Party Advisory

CVEs referencing this url
https://security-tracker.debian.org/tracker/CVE-2012-1168

CVE-2012-1168
Third Party Advisory

Jump to