CVE-2011-4589

Moodle 2.0.x-2.0.6 and 2.1.x-2.1.3 - Authenticated Course ID Number Overwrite via Restore Action

Title source: llm
STIX 2.1

Description

backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.

References (3)

Core 3
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=761248
Vendor Advisory x_refsource_confirm
http://moodle.org/mod/forum/discuss.php?d=191758

Scores

EPSS 0.0044
EPSS Percentile 63.4%

Details

CWE
CWE-264
Status published
Products (9)
moodle/moodle 2.0.0
moodle/moodle 2.0.1
moodle/moodle 2.0.2
moodle/moodle 2.0.3
moodle/moodle 2.0.4
moodle/moodle 2.0.5
moodle/moodle 2.1.0
moodle/moodle 2.1.1
moodle/moodle 2.1.2
Published Jul 20, 2012
Tracked Since Feb 18, 2026