CVE-2012-6099

Published: Jan 27, 2013Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.

Affected (22)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.1.0
Moodle Moodle	Version 2.1.1
Moodle Moodle	Version 2.1.2
Moodle Moodle	Version 2.1.3
Moodle Moodle	Version 2.1.4
Moodle Moodle	Version 2.1.5
Moodle Moodle	Version 2.1.6
Moodle Moodle	Version 2.1.7
Moodle Moodle	Version 2.1.8
Moodle Moodle	Version 2.1.9

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 2.2.0
Moodle Moodle	Version 2.2.1
Moodle Moodle	Version 2.2.2
Moodle Moodle	Version 2.2.3
Moodle Moodle	Version 2.2.4
Moodle Moodle	Version 2.2.5
Moodle Moodle	Version 2.2.6