Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/15348?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15348?format=api", "vulnerability_id": "VCID-b6nc-pmkm-3ua1", "summary": "Moodle Authentication Bypass in File Upload\nMoodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.", "aliases": [ { "alias": "CVE-2012-3387" }, { "alias": "GHSA-w66h-c2vj-cm7f" } ], "fixed_packages": [], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50775?format=api", "purl": "pkg:composer/moodle/moodle@2.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2e9f-d7rx-kqah" }, { "vulnerability": "VCID-36w8-8p24-n3bb" }, { "vulnerability": "VCID-3fdn-sk73-zqe2" }, { "vulnerability": "VCID-6spt-ggnj-zber" }, { "vulnerability": "VCID-9tcy-uad5-hyb8" }, { "vulnerability": "VCID-akut-458d-6bee" }, { "vulnerability": "VCID-b6nc-pmkm-3ua1" }, { "vulnerability": "VCID-bgbv-4kb1-3bhg" }, { "vulnerability": "VCID-bkcw-p2su-pkde" }, { "vulnerability": "VCID-era2-gy4n-6kdx" }, { "vulnerability": "VCID-f6mk-8r56-1yfe" }, { "vulnerability": "VCID-hxhr-sxkm-nka6" }, { "vulnerability": "VCID-j9xy-97ps-7fht" }, { "vulnerability": "VCID-kjwa-ezsm-pbg7" }, { "vulnerability": "VCID-mp12-mrm4-rbby" }, { "vulnerability": "VCID-qjdf-s39r-5bdb" }, { "vulnerability": "VCID-u1b3-2tg8-kfhv" }, { "vulnerability": "VCID-uhws-64fm-hybk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.3.0" } ], "references": [ { "reference_url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948" }, { "reference_url": "http://openwall.com/lists/oss-security/2012/07/17/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://openwall.com/lists/oss-security/2012/07/17/1" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3387", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41819", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.4183", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.4188", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.4189", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41914", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41879", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41867", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41917", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41809", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41874", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00198", "scoring_system": "epss", "scoring_elements": "0.41902", "published_at": "2026-04-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3387" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76954", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76954" }, { "reference_url": "https://github.com/moodle/moodle", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/moodle/moodle" }, { "reference_url": "https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334" }, { "reference_url": "https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb" }, { "reference_url": "https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3387", "reference_id": "CVE-2012-3387", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3387" }, { "reference_url": "https://github.com/advisories/GHSA-w66h-c2vj-cm7f", "reference_id": "GHSA-w66h-c2vj-cm7f", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-w66h-c2vj-cm7f" } ], "weaknesses": [ { "cwe_id": 1035, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, { "cwe_id": 264, "name": "Permissions, Privileges, and Access Controls", "description": "Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control." }, { "cwe_id": 937, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, { "cwe_id": 287, "name": "Improper Authentication", "description": "When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct." } ], "exploits": [], "severity_range_score": "4.0 - 6.9", "exploitability": "0.5", "weighted_severity": "6.2", "risk_score": 3.1, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-b6nc-pmkm-3ua1" }