CVE-2012-6103

Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to hijack the authentication of arbitrary users for requests that send course messages.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
VendorProductVersion
moodlemoodle
2.2.0
moodlemoodle
2.2.1
moodlemoodle
2.2.2
moodlemoodle
2.2.3
moodlemoodle
2.2.4
moodlemoodle
2.2.5
moodlemoodle
2.2.6
moodlemoodle
2.3.0
moodlemoodle
2.3.1
moodlemoodle
2.3.2
moodlemoodle
2.3.3
moodlemoodle
2.4.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
moodle
trusty
dne
saucy
not-affected
raring
ignored
quantal
ignored
precise
not-affected
oneiric
not-affected
lucid
not-affected
hardy
ignored
Common Weakness Enumeration
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36600
http://openwall.com/lists/oss-security/2013/01/21/1
https://moodle.org/mod/forum/discuss.php?d=220164
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36600
http://openwall.com/lists/oss-security/2013/01/21/1
https://moodle.org/mod/forum/discuss.php?d=220164