{"id":"CVE-2012-5471","aliases":["EUVD-2022-4603","GHSA-mpjx-8phj-5m34"],"status":"published","title":"Moodle Allows Unauthenticated Dropbox Access","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01265,"percentile":0.69915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-287"],"published":"2012-11-21T11:00:00Z","modified":"2026-06-16T23:46:50Z","fixes":[{"ecosystem":"Packagist","package":"moodle/moodle","fixed_in":["2.3.3","2.2.6","2.1.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"last_affected":"2.3.2"},{"fixed":"2.3.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"last_affected":"2.2.5"},{"fixed":"2.2.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"last_affected":"2.1.8"},{"fixed":"2.1.9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3"},{"fixed":"2.3.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2"},{"fixed":"2.2.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"moodle/moodle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"2.1.9"}]}]}],"products":[{"vendor":"moodle","product":"moodle"}],"references":[{"url":"http://www.securityfocus.com/bid/56505","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://moodle.org/mod/forum/discuss.php?d=216155","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-29872","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://openwall.com/lists/oss-security/2012/11/19/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5471","tags":["advisory"]},{"url":"https://github.com/moodle/moodle/commit/8eb614d4bb4a80ed51520bca528530914082136f","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/a3433213a1a2346c145e004ab1dc08b58279f910","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/c62a20c42b96f0195c4de075e5c58a4e7d381428","tags":["web"]},{"url":"https://github.com/moodle/moodle/commit/cd029574b699c74e55fa287f0b4db45d2dcf9fde","tags":["web"]},{"url":"https://web.archive.org/web/20121202030020/http://www.securityfocus.com/bid/56505","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mpjx-8phj-5m34"},{"url":"https://github.com/moodle/moodle","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2012-5471","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","status":"published","published":"2012-11-21T11:00:00Z","modified":"2024-08-06T21:05:47.227Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2022-4603","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","status":"published","published":"2012-11-21T11:00:00Z","modified":"2024-08-06T21:05:47Z","updated_at":"2026-11-03T01:56:04.46975Z"}],"ghsa":[{"id":"GHSA-mpjx-8phj-5m34","title":"Moodle Allows Unauthenticated Dropbox Access","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","status":"published","published":"2022-05-13T01:13:01Z","modified":"2024-01-11T23:03:10Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:30.812736Z"}],"nvd":[{"id":"CVE-2012-5471","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","status":"published","published":"2012-11-21T12:55:02.9Z","modified":"2026-06-16T23:46:50.517Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"GHSA-mpjx-8phj-5m34","title":"Moodle Allows Unauthenticated Dropbox Access","description":"The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.","status":"published","published":"2022-05-13T01:13:01Z","modified":"2024-01-11T23:41:37.746979Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}