Input validation error in Moodle - CVE-2012-1168
Published: November 14, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30617
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-1168
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.
Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.
Affected software
Moodle
Fedora
moodle
Fedora
moodle
How to mitigate CVE-2012-1168
Install update from vendor's website.
Moodle - update to 2.2.2
moodle - addressed in versions 2.1.5-1.el6, 2.1.5-2.el6, 2.1.5-3.el6
moodle - addressed in versions 2.1.5-1.el6, 2.1.5-2.el6, 2.1.5-3.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html
- https://access.redhat.com/security/cve/cve-2012-1168
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1168
- https://moodle.org/mod/forum/discuss.php?d=198622
- https://security-tracker.debian.org/tracker/CVE-2012-1168