Description

backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.

Remediation

References

CVE-2011-4589

Related Vulnerabilities

WordPress Plugin Sender by BestWebSoft Cross-Site Scripting (1.2.0)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16147)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-7060)

phpList Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-3953)

Drupal Core 9.0.x Remote Code Execution (9.0.0 - 9.0.7)

Severity

Medium

Classification

CVE-2011-4589 CWE-264

Tags

Missing Update Known Vulnerabilities