Description

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.

Remediation

References

CVE-2012-4408

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2005-3445)

Java Unspesificed Vulnerability (CVE-2018-3139)

WordPress 5.6.x PHP Object Injection (5.6 - 5.6.3)

WordPress Plugin WPMktgEngine Security Bypass (3.7.6)

Joomla! Core 1.5.x Cross-Site Scripting (1.5.0 - 1.5.9)

Severity

Medium

Classification

CVE-2012-4408 CWE-264

Tags

Missing Update Known Vulnerabilities