NVD

Id
47046  
Name
CVE-2012-6098  
Description
grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into standard site-wide outcomes by leveraging the teacher role and using the re-editing feature.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2013-01-27  
Modified Date
2013-01-30  
Seq
2012-6098  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235630 47046 CVE-2012-6098 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-27619  View
235631 47046 CVE-2012-6098 [oss-security] 20130121 Moodle security notifications public  View
235632 47046 CVE-2012-6098 https://moodle.org/mod/forum/discuss.php?d=220158  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19716 JVNDB-2013-001291 Moodle におけるカスタム結果を標準のサイト全体の成果に変換される脆弱性 Moodle の grade/edit/outcome/edit_form.php は、moodle/grade:manage ケイパビリティの要件を適切に実施しないため、カスタム結果を標準のサイト全体の成果に変換される脆弱性が存在します。 CVE-2012-6098 59336 CVE-2012-6098 47046 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001291.html 2013-01-21 2013-01-29 View