{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43783?format=json","vulnerability_id":"VCID-kqg2-2xqk-q7ga","summary":"Moodle Authentication Bypass in File Upload\nMoodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","aliases":[{"alias":"CVE-2012-3387"},{"alias":"GHSA-w66h-c2vj-cm7f"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62870?format=json","purl":"pkg:composer/moodle/moodle@2.3.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.3.1"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/62102?format=json","purl":"pkg:composer/moodle/moodle@2.3.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1uce-2wtr-8bfg"},{"vulnerability":"VCID-2676-n5ah-aqbh"},{"vulnerability":"VCID-2vsp-tbwq-1qhf"},{"vulnerability":"VCID-41up-e414-hyba"},{"vulnerability":"VCID-8c87-x99e-tqav"},{"vulnerability":"VCID-9kbu-4u3w-jufu"},{"vulnerability":"VCID-b2tv-8q9g-qqfz"},{"vulnerability":"VCID-bgaz-b5zd-e7aj"},{"vulnerability":"VCID-et8t-f1u1-kudb"},{"vulnerability":"VCID-fu6f-fjmn-g7eh"},{"vulnerability":"VCID-fwn7-hez1-ayhj"},{"vulnerability":"VCID-kqg2-2xqk-q7ga"},{"vulnerability":"VCID-mh2f-ytz5-9fhg"},{"vulnerability":"VCID-pca7-qesm-qudu"},{"vulnerability":"VCID-qgn8-zs2m-vkc4"},{"vulnerability":"VCID-r7wm-grca-3fgw"},{"vulnerability":"VCID-vgxb-fkuj-9fgk"},{"vulnerability":"VCID-y15n-cf9z-dyc4"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/moodle/moodle@2.3.0"}],"references":[{"reference_url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948","reference_id":"","reference_type":"","scores":[],"url":"http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33948"},{"reference_url":"http://openwall.com/lists/oss-security/2012/07/17/1","reference_id":"","reference_type":"","scores":[],"url":"http://openwall.com/lists/oss-security/2012/07/17/1"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/76954","reference_id":"","reference_type":"","scores":[],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/76954"},{"reference_url":"https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334"},{"reference_url":"https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb"},{"reference_url":"https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3387","reference_id":"CVE-2012-3387","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3387"},{"reference_url":"https://github.com/advisories/GHSA-w66h-c2vj-cm7f","reference_id":"GHSA-w66h-c2vj-cm7f","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w66h-c2vj-cm7f"}],"weaknesses":[{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."},{"cwe_id":264,"name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."}],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kqg2-2xqk-q7ga"}