Information disclosure in Moodle

CVE-2012-6105

blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed.

Vulnerability class: Information Disclosure

EPSS: 0.014 (69.7th percentile) — read the EPSS interpretation.

Affected products

Moodle — versions 2.1.0, 2.1.1, 2.1.2
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_MLIST)