Description
rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed.
Remediation
References
Related Vulnerabilities
MySQL CVE-2016-3424 Vulnerability (CVE-2016-3424)
PHP Improper Input Validation Vulnerability (CVE-2010-3709)
Apache Tomcat Other Vulnerability (CVE-2002-0936)
WordPress Plugin Import and export users and customers CSV Injection (1.16.3.5)
Django Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2021-31542)