Description

lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.

Remediation

References

CVE-2012-6102

Related Vulnerabilities

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-7838)

Zikula Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2016-9835)

WordPress Plugin wp superb Slideshow 'upload.php' Arbitrary File Upload (2.2)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-1606)

WordPress Plugin Restaurant Menu-Food Ordering System-Table Reservation Cross-Site Request Forgery (2.3.1)

Severity

Medium

Classification

CVE-2012-6102 CWE-264

Tags

Missing Update Known Vulnerabilities