NVD

Id
47054  
Name
CVE-2012-6106  
Description
calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object.  
Reject
 
CVSS Version
2  
CVSS Score
5.5  
Severity
Medium  
CVSS Base Score
5.5  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2013-01-27  
Modified Date
2013-01-30  
Seq
2012-6106  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
235654 47054 CVE-2012-6106 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37106  View
235655 47054 CVE-2012-6106 [oss-security] 20130121 Moodle security notifications public  View
235656 47054 CVE-2012-6106 https://moodle.org/mod/forum/discuss.php?d=220167  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19724 JVNDB-2013-001299 Moodle におけるコースレベルのカレンダーのサブスクリプションを削除される脆弱性 Moodle の Manage Subscription の実装内の calendar/managesubscriptions.php は、機能チェック (capability check) を省略するため、コースレベルのカレンダーのサブスクリプションを削除される脆弱性が存在します。 CVE-2012-6106 59344 CVE-2012-6106 47054 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001299.html 2013-01-21 2013-01-29 View