CVE-2012-3388
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1...
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
Exploit likelihood
What each source reports
NVD Score used
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
- Record
CVE-2012-3388- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
- Record
CVE-2012-3388- Updated
- 2026-11-02
EUVDEUVD-2012-3359 No score
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
- Record
EUVD-2012-3359- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mxp2-wcjh-jf72 No score
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1...
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
- Record
GHSA-mxp2-wcjh-jf72- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-3388 No score
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
- Record
UBUNTU-CVE-2012-3388- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3388 is a medium vulnerability (CVSS 4.0) in Moodle, published July 23, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. No source names a fixed version.
References
exchange.xforce.ibmcloud.com/vulnerabilities/76955
secunia.com/advisories/49890
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33916
openwall.com/lists/oss-security/2012/07/17/1
securityfocus.com/bid/54481
nvd.nist.gov/vuln/detail/CVE-2012-3388
github.com/advisories/GHSA-mxp2-wcjh-jf72
ubuntu.com/security/CVE-2012-3388
cve.org/CVERecord?id=CVE-2012-3388