CVE-2012-2366
Published: 21 July 2012
mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors.
Notes
Author | Note |
---|---|
jdstrand | moodle 2.1 and higher |
Priority
Status
Package | Release | Status |
---|---|---|
moodle Launchpad, Ubuntu, Debian |
vivid |
Ignored
(end of life)
|
artful |
Ignored
(end of life)
|
|
bionic |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
cosmic |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
hardy |
Ignored
(end of life)
|
|
lucid |
Not vulnerable
|
|
natty |
Not vulnerable
|
|
oneiric |
Not vulnerable
|
|
precise |
Not vulnerable
(1.9.9.dfsg2-6)
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Does not exist
(trusty was not-affected [2.5.4-1ubuntu1])
|
|
upstream |
Released
(2.2.3.dfsg-1)
|
|
utopic |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Not vulnerable
(2.5.4-1ubuntu1)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
Patches: upstream: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31763 |