FKIE_CVE-2012-3396

Vulnerability from fkie_nvd - Published: 2012-07-23 21:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.
References
secalert@redhat.comhttp://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34045
secalert@redhat.comhttp://openwall.com/lists/oss-security/2012/07/17/1
secalert@redhat.comhttp://secunia.com/advisories/49890
secalert@redhat.comhttp://www.securityfocus.com/bid/54481
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/76962
af854a3a-2127-422b-91ae-364da2661108http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34045
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2012/07/17/1
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/49890
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/54481
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/76962
Impacted products
Vendor Product Version
moodle moodle 2.0.0
moodle moodle 2.0.1
moodle moodle 2.0.2
moodle moodle 2.0.3
moodle moodle 2.0.4
moodle moodle 2.0.5
moodle moodle 2.0.6
moodle moodle 2.0.7
moodle moodle 2.0.8
moodle moodle 2.0.9
moodle moodle 2.1.0
moodle moodle 2.1.1
moodle moodle 2.1.2
moodle moodle 2.1.3
moodle moodle 2.1.4
moodle moodle 2.1.5
moodle moodle 2.1.6
moodle moodle 2.2.0
moodle moodle 2.2.1
moodle moodle 2.2.2
moodle moodle 2.2.3
moodle moodle 2.3.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD248A1D-CACC-4E76-925A-078B736442AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B8A0403-0869-495F-B7C0-13A387549C7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "39791F43-CF89-485B-AA8B-634C282BB025",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "428E4846-8C9E-4592-8437-88FCDCED704D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4096977-3258-48B0-9C7B-D43FBC8BB1EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "448E5353-CD0E-407C-84F4-5E6D014A28FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D57A08BD-67FA-4899-96BD-C84896321E51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D1221DB-8DD0-4DB6-AAF8-BE80C7B4F58F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "481F0F56-7FF1-4B40-B231-A39B66353646",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1DA44C3-AD18-4EBE-BE3C-7D695E52EC42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "18C6F348-DAE9-4440-8B3A-8D92ADC6606F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "367537BF-CBDF-4CBB-91B4-6E5A567EF605",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DABBF325-C48A-4838-AC5D-0565C78976CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "02B72177-DFB0-4242-9ED6-068E5751579B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7226EE65-CC9F-4FDA-9791-3C8047D5C04C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FDC55ECE-8185-4FC0-A4C9-14AABD136650",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADFDE1FC-992E-4610-A62D-282B448402AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "15A73CE2-73DA-4274-89E0-DD9A413ED17F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "39075F6E-2925-4897-B1DE-C86A066DF54B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "179DBC2B-B35F-4A19-B522-DF996D5E13E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA527724-B44E-46B6-BA53-A83B012EA376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFD575CF-2AF2-443F-841D-F7E25FBD455A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en cohort/edit_form.php en Moodle v2.0.x anteriores a v2.0.10, v2.1.x anteriores a v2.1.7, v2.2.x anteriores a v2.2.4, y v2.3.x anteriores a v2.3.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del campo idnumber. NOTA: esta vulnerabilidad existe debido a una mala implementaci\u00f3n de la soluci\u00f3n para CVE-2012-2365."
    }
  ],
  "id": "CVE-2012-3396",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-07-23T21:55:04.937",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-34045"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://openwall.com/lists/oss-security/2012/07/17/1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/49890"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/54481"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76962"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-34045"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://openwall.com/lists/oss-security/2012/07/17/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/49890"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/54481"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76962"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.