CVE-2012-2354
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the...
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
Exploit likelihood
What each source reports
NVD Score used
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
- Record
CVE-2012-2354- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
- Record
CVE-2012-2354- Updated
- 2026-11-02
EUVDEUVD-2012-2346 No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
- Record
EUVD-2012-2346- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-594q-rvf2-x42j No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the...
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
- Record
GHSA-594q-rvf2-x42j- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2354 No score
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
- Record
UBUNTU-CVE-2012-2354- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2354 is a medium vulnerability (CVSS 4.0) in Moodle, published July 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. No source names a fixed version.
References
git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48e03792ca8faa2d781f9ef74606f3b3f0d3baec
openwall.com/lists/oss-security/2012/05/23/2
nvd.nist.gov/vuln/detail/CVE-2012-2354
github.com/advisories/GHSA-594q-rvf2-x42j
ubuntu.com/security/CVE-2012-2354
cve.org/CVERecord?id=CVE-2012-2354