Description

theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.

Remediation

References

CVE-2012-4403

Related Vulnerabilities

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-4039)

WordPress Plugin Livefyre Comments 3 Cross-Site Scripting (4.1.4)

Oracle Database Server CVE-2014-4292 Vulnerability (CVE-2014-4292)

b2evolution Other Vulnerability (CVE-2006-6417)

Drupal Core 6.x Remote Code Execution (6.0 - 6.38)

Severity

Medium

Classification

CVE-2012-4403 CWE-200

Tags

Missing Update Known Vulnerabilities