What is GHSA-wxvp-8q8h-r6rr?

GHSA-wxvp-8q8h-r6rr is a security advisory published by GitHub Security Advisories with Medium severity. Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory

Which CVE IDs does GHSA-wxvp-8q8h-r6rr cover?

GHSA-wxvp-8q8h-r6rr covers the following CVE IDs: CVE-2011-4293. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-wxvp-8q8h-r6rr?

GHSA-wxvp-8q8h-r6rr affects 2 products, including: composer/moodle/moodle:\u003e= 2.0, \u003c 2.0.4; composer/moodle/moodle:\u003e= 2.1, \u003c 2.1.1.

GHSA-wxvp-8q8h-r6rrMedium

Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 17, 2024

🔗 CVE IDs covered (1)

CVE-2011-4293 →

📋 Description

The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.

🎯 Affected products2

composer/moodle/moodle:>= 2.0, < 2.0.4
composer/moodle/moodle:>= 2.1, < 2.1.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2011-4293
http://git.moodle.org/gw?p=moodle.git;a=commit;h=e1c2a211f259821910be2cba23679d4176fb00a3
http://moodle.org/mod/forum/discuss.php?d=182736
http://openwall.com/lists/oss-security/2011/11/14/1
https://github.com/moodle/moodle/commit/05f4555422278190ec24a88466ac43c914a7e5d6
https://github.com/moodle/moodle/commit/9a380fbb53429713b3c422a3146456dc97205329
https://github.com/moodle/moodle/commit/e1c2a211f259821910be2cba23679d4176fb00a3
https://github.com/advisories/GHSA-wxvp-8q8h-r6rr