Description

The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.

Remediation

References

CVE-2012-6099

Related Vulnerabilities

WordPress Plugin Structured Content (JSON-LD) #wpsc Cross-Site Scripting (1.5)

Opencart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21516)

WordPress Plugin WPS Hide Login Multiple Security Bypass Vulnerabilities (1.5.2.2)

XOOPS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-4433)

WordPress Plugin Crony Cronjob Manager Multiple Vulnerabilities (0.4.4)

Severity

Medium

Classification

CVE-2012-6099 CWE-20

Tags

Missing Update Known Vulnerabilities