Description

The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.

Remediation

References

CVE-2012-6099

Related Vulnerabilities

WordPress Plugin RK Responsive Contact Form SQL Injection (1.0.0)

WordPress Plugin LeadConnector Security Bypass (1.7)

WordPress Plugin Popup by Supsystic Cross-Site Request Forgery (1.7.8)

WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Multiple SQL Injection Vulnerabilities (3.8.2)

Magento Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2020-9578)

Severity

Medium

Classification

CVE-2012-6099 CWE-20

Tags

Missing Update Known Vulnerabilities