GHSA-xr24-jp5c-6c4v

Source

https://github.com/advisories/GHSA-xr24-jp5c-6c4v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xr24-jp5c-6c4v/GHSA-xr24-jp5c-6c4v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xr24-jp5c-6c4v

Aliases

CVE-2013-1831

Published

2022-05-13T01:12:57Z

Modified

2024-12-05T05:38:39.182548Z

Summary

Moodle reveals absolute path in exception message

Details

lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.

Database specific

{
    "nvd_published_at": "2013-03-25T21:55:00Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-22T15:58:11Z"
}

References

Affected packages

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2.1.10

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.8

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.5

Affected versions

v2.*

v2.3.4

Packagist / moodle/moodle

Package

Name: moodle/moodle
Purl: pkg:composer/moodle/moodle

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.4.0

Fixed

2.4.2

Affected versions

v2.*

v2.4.0

v2.4.1