Description

The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.

Remediation

References

CVE-2011-4300

Related Vulnerabilities

ownCloud CVE-2013-0302 Vulnerability (CVE-2013-0302)

ColdFusion User-Agent cross-site scripting

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5286)

Drupal Core 6.x Security Bypass (6.0 - 6.1)

WebLogic Improper Input Validation Vulnerability (CVE-2017-15707)

Severity

Medium

Classification

CVE-2011-4300 CWE-264

Tags

Missing Update Known Vulnerabilities