Description

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.

Remediation

References

CVE-2013-5674

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2006-1884)

Joomla Incorrect Authorization Vulnerability (CVE-2020-11889)

Apache Tomcat Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4590)

WordPress Plugin YITH WooCommerce Zoom Magnifier Cross-Site Scripting (1.1.8)

Dolibarr Files or Directories Accessible to External Parties Vulnerability (CVE-2023-33568)

Severity

High

Classification

CVE-2013-5674 CWE-94

Tags

Missing Update Known Vulnerabilities