CVE-2012-3392

Published: Jul 23, 2012Modified: Apr 29, 2026

5.5

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability: 8.0 / Impact: 4.9

Source: NVD

Description

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums.

Affected (11)

Products: Moodle: Moodle

1 product

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.1.0
Moodle Moodle	Version 2.1.1
Moodle Moodle	Version 2.1.2
Moodle Moodle	Version 2.1.3
Moodle Moodle	Version 2.1.4
Moodle Moodle	Version 2.1.5
Moodle Moodle	Version 2.1.6
Moodle Moodle	Version 2.2.0
Moodle Moodle	Version 2.2.1
Moodle Moodle	Version 2.2.2
Moodle Moodle	Version 2.2.3

Related CWEs

References (10)

http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-31460

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2012/07/17/1

Source: secalert@redhat.com

http://secunia.com/advisories/49890

Source: secalert@redhat.com

http://www.securityfocus.com/bid/54481

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/76958

Source: secalert@redhat.com

http://git.moodle.org/gw?p=moodle.git&a=search&h=refs%2Fheads%2FMOODLE_22_STABLE&st=commit&s=MDL-31460

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2012/07/17/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/49890

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/54481

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/76958

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.