Description

lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.

Remediation

References

CVE-2012-3390

Related Vulnerabilities

WordPress Plugin WordPress Users 'uid' Parameter SQL Injection (1.3)

MySQL CVE-2016-5632 Vulnerability (CVE-2016-5632)

Joomla CVE-2018-15881 Vulnerability (CVE-2018-15881)

WordPress Plugin Webmention Cross-Site Scripting (4.0.8)

Oracle JRE CVE-2013-0433 Vulnerability (CVE-2013-0433)

Severity

Low

Classification

CVE-2012-3390 CWE-264

Tags

Missing Update Known Vulnerabilities