Description

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.

Remediation

References

CVE-2012-4408

Related Vulnerabilities

WordPress Plugin Slimstat Analytics SQL Injection (4.9.3.3)

Oracle JRE CVE-2013-2438 Vulnerability (CVE-2013-2438)

WordPress Plugin Twitch Player Cross-Site Scripting (2.1.0)

osTicket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1315)

WordPress Plugin Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Multiple Cross-Site Scripting Vulnerabilities (9.7.3)

Severity

Medium

Classification

CVE-2012-4408 CWE-264

Tags

Missing Update Known Vulnerabilities