Description

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.

Remediation

References

CVE-2012-2354

Related Vulnerabilities

Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2009-2902)

WordPress Plugin Spotlight Social Feeds [Block, Shortcode, and Widget] Security Bypass (0.10.1)

Apache HTTP Server CVE-2014-0098 Vulnerability (CVE-2014-0098)

Oracle Database Server CVE-2012-1745 Vulnerability (CVE-2012-1745)

WordPress Plugin Visitor Traffic Real Time Statistics Unspecified Vulnerability (4.2)

Severity

Medium

Classification

CVE-2012-2354 CWE-264

Tags

Missing Update Known Vulnerabilities