CVE-2011-4288

Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=79c6e3a0968ee1fedcf8a1f14f8086fcd9dbd3f6
http://moodle.org/mod/forum/discuss.php?d=175590	Vendor Advisory
http://openwall.com/lists/oss-security/2011/11/14/1

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle:1.9.2:::::::*
	cpe:2.3:a:moodle:moodle:1.9.3:::::::*
	cpe:2.3:a:moodle:moodle:1.9.4:::::::*
	cpe:2.3:a:moodle:moodle:1.9.5:::::::*
	cpe:2.3:a:moodle:moodle:1.9.6:::::::*
	cpe:2.3:a:moodle:moodle:1.9.7:::::::*
	cpe:2.3:a:moodle:moodle:1.9.8:::::::*
	cpe:2.3:a:moodle:moodle:1.9.9:::::::*
	cpe:2.3:a:moodle:moodle:1.9.10:::::::*
	cpe:2.3:a:moodle:moodle:1.9.11:::::::*
	cpe:2.3:a:moodle:moodle:2.0.0:::::::*
	cpe:2.3:a:moodle:moodle:2.0.1:::::::*
	cpe:2.3:a:moodle:moodle:2.0.2:::::::*

History

No history.

Information

Published : 2012-07-16 10:28

Updated : 2024-02-28 12:00

NVD link : CVE-2011-4288

Mitre link : CVE-2011-4288

CVE.ORG link : CVE-2011-4288

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-4288", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-07-16T10:28:36.783", "references": [{"url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=79c6e3a0968ee1fedcf8a1f14f8086fcd9dbd3f6", "source": "secalert@redhat.com"}, {"url": "http://moodle.org/mod/forum/discuss.php?d=175590", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://openwall.com/lists/oss-security/2011/11/14/1", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role."}, {"lang": "es", "value": "Moodle v1.9.x anterior a v1.9.12 y v2.0.x anterior a v2.0.3 no aplica correctamente las asociaciones entre los profesores y los grupos, lo que permite a usuarios remotos autenticados leer los informes de examen de los estudiantes arbitrarios mediante el aprovechamiento de la funci\u00f3n docente."}], "lastModified": "2023-02-13T04:32:45.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:1.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7F24649-B67F-4809-9F54-7B623AEF5A4A"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B81655E-C3B5-4115-A4C4-B7AC2FCDAB7F"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED9C3840-66BE-47EC-9F0C-E9D2171FF0B2"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DBD062EB-1B1F-4DC8-A4F9-C2EC7D401E9D"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "291F73E9-1059-4E7F-860F-0DF2A35AA456"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EB5859E-0996-46B5-BB44-34BD6EACBCF5"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F87F6707-99AB-478A-909D-1D87298D5514"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BCE8B26-58BB-471C-B291-E6AE22B96C5B"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "768CE5AF-955B-4148-998A-A46BBDBA618B"}, {"criteria": "cpe:2.3:a:moodle:moodle:1.9.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4283440F-9B21-4CE9-81FF-79DF3DEDCEE7"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD248A1D-CACC-4E76-925A-078B736442AE"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B8A0403-0869-495F-B7C0-13A387549C7A"}, {"criteria": "cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39791F43-CF89-485B-AA8B-634C282BB025"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}