Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-cr78-rphw-w73p
Advisory ID github_osv/GHSA-cr78-rphw-w73p
Aliases CVE-2012-6099
Summary Moodle Arbitrary File Read via Backup Functionality The moodle1 backup converter in `backup/converter/moodle1/lib.php` in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
generic_textual MODERATE
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36977
http://openwall.com/lists/oss-security/2013/01/21/1
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/0ab681d3e7bed2a37430387f9da8504c0b077d10
https://github.com/moodle/moodle/commit/7b66137f7bcc84fb5eb07f58fb658b21bf37cc44
https://moodle.org/mod/forum/discuss.php?d=220160
CVE-2012-6099 https://nvd.nist.gov/vuln/detail/CVE-2012-6099
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.