Description

calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object.

Remediation

References

CVE-2012-6106

Related Vulnerabilities

WordPress Plugin Article Directory Cross-Site Scripting (1.3)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-7937)

PHP-Fusion Authentication Bypass by Capture-replay Vulnerability (CVE-2020-23178)

Jenkins Incorrect Authorization Vulnerability (CVE-2017-2599)

LimeSurvey CVE-2019-16181 Vulnerability (CVE-2019-16181)

Severity

Medium

Classification

CVE-2012-6106 CWE-264

Tags

Missing Update Known Vulnerabilities