Vulnerability Details : CVE-2012-3388
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
Products affected by CVE-2012-3388
- cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-3388
0.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 47 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-3388
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2012-3388
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-3388
-
http://openwall.com/lists/oss-security/2012/07/17/1
oss-security - Moodle security notifications public
-
http://secunia.com/advisories/49890
Sign in
-
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33916
Official Moodle git projects - moodle.git/search
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/76955
Moodle cached users security bypass CVE-2012-3388 Vulnerability Report
-
http://www.securityfocus.com/bid/54481
Moodle Multiple Security Vulnerabilities
Jump to