Description

The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.

Remediation

References

CVE-2011-4300

Related Vulnerabilities

WordPress Plugin Client Invoicing by Sprout Invoices-Easy Estimates and Invoices for WordPress Cross-Site Scripting (19.9.6)

MySQL CVE-2022-21454 Vulnerability (CVE-2022-21454)

WordPress Plugin WOOCS-Currency Switcher for WooCommerce Professional Cross-Site Scripting (1.3.7.2)

WordPress Plugin WP eCommerce Multiple Vulnerabilities (3.9.1)

WordPress Plugin Database for Contact Form 7, WPforms, Elementor forms Arbitrary File Upload (1.3.2)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2011-4300