CVE-2011-4586

Moodle 1.9.x < 1.9.15, 2.0.x < 2.0.6, 2.1.x < 2.1.3 - HTTP Response Splitting via Calendar Subsystem

Title source: llm
STIX 2.1

Description

CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

References (4)

Core 4
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=761248
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2421
Vendor Advisory x_refsource_confirm
http://moodle.org/mod/forum/discuss.php?d=191754

Scores

EPSS 0.0038
EPSS Percentile 59.4%

Details

Status published
Products (23)
moodle/moodle 1.9.1
moodle/moodle 1.9.2
moodle/moodle 1.9.3
moodle/moodle 1.9.4
moodle/moodle 1.9.5
moodle/moodle 1.9.6
moodle/moodle 1.9.7
moodle/moodle 1.9.8
moodle/moodle 1.9.9
moodle/moodle 1.9.10
... and 13 more
Published Jul 20, 2012
Tracked Since Feb 18, 2026