Description

lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.

Remediation

References

CVE-2012-3390

Related Vulnerabilities

WordPress Plugin Gutenberg & Elementor Templates Importer For Responsive Security Bypass (2.2.5)

WordPress Plugin Product Subtitle For WooCommerce Arbitrary File Disclosure (4.1)

WebLogic CVE-2018-3248 Vulnerability (CVE-2018-3248)

Bootstrap Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-14042)

LimeSurvey CVE-2019-16176 Vulnerability (CVE-2019-16176)

Severity

Low

Classification

CVE-2012-3390 CWE-264

Tags

Missing Update Known Vulnerabilities