CVE-2012-2354 - Vulnerability Details - OpenCVE

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

Vendors	Products
Moodle	Moodle

Configuration 1 [-]

OR	cpe:2.3:a:moodle:moodle:2.1.0:::::::*
	cpe:2.3:a:moodle:moodle:2.1.1:::::::*
	cpe:2.3:a:moodle:moodle:2.1.2:::::::*
	cpe:2.3:a:moodle:moodle:2.1.3:::::::*
	cpe:2.3:a:moodle:moodle:2.1.4:::::::*
	cpe:2.3:a:moodle:moodle:2.1.5:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:moodle:moodle:2.2.0:::::::*
	cpe:2.3:a:moodle:moodle:2.2.1:::::::*
	cpe:2.3:a:moodle:moodle:2.2.2:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2012-2346	Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec
http://openwall.com/lists/oss-security/2012/05/23/2

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2012-07-21T01:00:00

Updated: 2024-08-06T19:34:25.695Z

Reserved: 2012-04-19T00:00:00

Link: CVE-2012-2354

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2012-07-21T03:38:55.813

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-2354

Redhat

No data.

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "18C6F348-DAE9-4440-8B3A-8D92ADC6606F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "367537BF-CBDF-4CBB-91B4-6E5A567EF605", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "DABBF325-C48A-4838-AC5D-0565C78976CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "02B72177-DFB0-4242-9ED6-068E5751579B", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "7226EE65-CC9F-4FDA-9791-3C8047D5C04C", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "FDC55ECE-8185-4FC0-A4C9-14AABD136650", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "15A73CE2-73DA-4274-89E0-DD9A413ED17F", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "39075F6E-2925-4897-B1DE-C86A066DF54B", "vulnerable": true}, {"criteria": "cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "179DBC2B-B35F-4A19-B522-DF996D5E13E4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the \"Recent conversations\" feature with a modified parameter in a URL."}, {"lang": "es", "value": "Moodle v2.1.x anteriores a v2.1.6 y v2.2.x anteriores a v2.2.3 permite a usuarios remotos autenticados a evitar los requisitos de la caracter\u00edstica moodle/site:readallmessages y leer mensajes utilizando la caracter\u00edstica \"Recent conversations\" con un par\u00e1metro modificado en la URL."}], "id": "CVE-2012-2354", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-07-21T03:38:55.813", "references": [{"source": "secalert@redhat.com", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec"}, {"source": "secalert@redhat.com", "url": "http://openwall.com/lists/oss-security/2012/05/23/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://openwall.com/lists/oss-security/2012/05/23/2"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}