{"id":"CVE-2012-3387","aliases":["EUVD-2022-5508","GHSA-w66h-c2vj-cm7f","UBUNTU-CVE-2012-3387"],"status":"published","title":"Moodle Authentication Bypass in File Upload","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01128,"percentile":0.66577,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-287"],"published":"2012-07-23T21:00:00Z","modified":"2026-06-16T23:43:07Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.1"}]}]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-33948","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/49890","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2012/07/17/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.securityfocus.com/bid/54481","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/76954","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3387","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/3b6629c088f14c6ee8f13a009ff27441d164f334","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/61a339e59857fd36080f4a468a16cd6a539d90bb","tags":["web"]},{"url":"https://web.archive.org/web/20121104220059/http://www.securityfocus.com/bid/54481","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w66h-c2vj-cm7f"},{"url":"https://github.com/moodle/moodle","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2012-3387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3387","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2012-3387","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"published","published":"2012-07-23T21:00:00Z","modified":"2024-08-06T20:05:12.351Z","updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2022-5508","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"published","published":"2012-07-23T21:00:00Z","modified":"2024-08-06T20:05:12Z","updated_at":"2026-11-03T01:56:10.882899Z"}],"ghsa":[{"id":"GHSA-w66h-c2vj-cm7f","title":"Moodle Authentication Bypass in File Upload","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-01-11T22:06:35Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-3387","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"published","published":"2012-07-23T21:55:04.513Z","modified":"2026-06-16T23:43:07.43Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"GHSA-w66h-c2vj-cm7f","title":"Moodle Authentication Bypass in File Upload","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"published","published":"2022-05-13T01:12:59Z","modified":"2024-01-11T22:26:36.058936Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2012-3387","description":"Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.","status":"withdrawn","published":"2012-07-23T21:55:00Z","modified":"2025-07-16T07:30:56.394301Z","updated_at":"2026-11-02T15:54:06.395274Z"}]}}