Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/43783?format=api",
    "vulnerability_id": "VCID-kqg2-2xqk-q7ga",
    "summary": "Moodle Authentication Bypass in File Upload\nMoodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.",
    "aliases": [
        {
            "alias": "CVE-2012-3387"
        },
        {
            "alias": "GHSA-w66h-c2vj-cm7f"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62870?format=api",
            "purl": "pkg:composer/moodle/moodle@2.3.1",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.3.1"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/62102?format=api",
            "purl": "pkg:composer/moodle/moodle@2.3.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-1uce-2wtr-8bfg"
                },
                {
                    "vulnerability": "VCID-2676-n5ah-aqbh"
                },
                {
                    "vulnerability": "VCID-2vsp-tbwq-1qhf"
                },
                {
                    "vulnerability": "VCID-41up-e414-hyba"
                },
                {
                    "vulnerability": "VCID-8c87-x99e-tqav"
                },
                {
                    "vulnerability": "VCID-9kbu-4u3w-jufu"
                },
                {
                    "vulnerability": "VCID-b2tv-8q9g-qqfz"
                },
                {
                    "vulnerability": "VCID-bgaz-b5zd-e7aj"
                },
                {
                    "vulnerability": "VCID-et8t-f1u1-kudb"
                },
                {
                    "vulnerability": "VCID-fu6f-fjmn-g7eh"
                },
                {
                    "vulnerability": "VCID-fwn7-hez1-ayhj"
                },
                {
                    "vulnerability": "VCID-kqg2-2xqk-q7ga"
                },
                {
                    "vulnerability": "VCID-mh2f-ytz5-9fhg"
                },
                {
                    "vulnerability": "VCID-pca7-qesm-qudu"
                },
                {
                    "vulnerability": "VCID-qgn8-zs2m-vkc4"
                },
                {
                    "vulnerability": "VCID-r7wm-grca-3fgw"
                },
                {
                    "vulnerability": "VCID-vgxb-fkuj-9fgk"
                },
                {
                    "vulnerability": "VCID-y15n-cf9z-dyc4"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.3.0"
        }
    ],
    "references": [
        {
            "reference_url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948"
        },
        {
            "reference_url": "http://openwall.com/lists/oss-security/2012/07/17/1",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "http://openwall.com/lists/oss-security/2012/07/17/1"
        },
        {
            "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76954",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76954"
        },
        {
            "reference_url": "https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334"
        },
        {
            "reference_url": "https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb"
        },
        {
            "reference_url": "https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3387",
            "reference_id": "CVE-2012-3387",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3387"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-w66h-c2vj-cm7f",
            "reference_id": "GHSA-w66h-c2vj-cm7f",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-w66h-c2vj-cm7f"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 264,
            "name": "Permissions, Privileges, and Access Controls",
            "description": "Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kqg2-2xqk-q7ga"
}