{"api_version":"1","generated_at":"2026-07-23T04:26:34+00:00","cve":"CVE-2011-4293","urls":{"html":"https://cve.report/CVE-2011-4293","api":"https://cve.report/api/cve/CVE-2011-4293.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-4293","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-4293"},"summary":{"title":"CVE-2011-4293","description":"The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.","state":"PUBLISHED","assigner":"redhat","published_at":"2012-07-16 10:28:37","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://moodle.org/mod/forum/discuss.php?d=182736","name":"http://moodle.org/mod/forum/discuss.php?d=182736","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Moodle.org: MSA-11-0019: Themes writing to files outside Moodle data directory","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3","name":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Official Moodle git projects - moodle.git/commit","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"http://openwall.com/lists/oss-security/2011/11/14/1","name":"http://openwall.com/lists/oss-security/2011/11/14/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: Fwd: DSA 2338-1 moodle security update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=e1c2a211f259821910be2cba23679d4176fb00a3","name":"CONFIRM:http://git.moodle.org/gw?p=moodle.git;a=commit;h=e1c2a211f259821910be2cba23679d4176fb00a3","refsource":"MITRE","tags":[],"title":"Official Moodle git projects - moodle.git/commit","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4293","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4293","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"4293","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4293","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4293","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4293","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2011","cve_id":"4293","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"moodle","cpe5":"moodle","cpe6":"2.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:01:51.512Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://moodle.org/mod/forum/discuss.php?d=182736"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-11-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2012-07-25T09:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"tags":["x_refsource_CONFIRM"],"url":"http://moodle.org/mod/forum/discuss.php?d=182736"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2011-4293","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[oss-security] 20111113 Re: Fwd: DSA 2338-1 moodle security update","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2011/11/14/1"},{"name":"http://moodle.org/mod/forum/discuss.php?d=182736","refsource":"CONFIRM","url":"http://moodle.org/mod/forum/discuss.php?d=182736"},{"name":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=e1c2a211f259821910be2cba23679d4176fb00a3","refsource":"CONFIRM","url":"http://git.moodle.org/gw?p=moodle.git;a=commit;h=e1c2a211f259821910be2cba23679d4176fb00a3"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2011-4293","datePublished":"2012-07-16T10:00:00.000Z","dateReserved":"2011-11-04T00:00:00.000Z","dateUpdated":"2024-08-07T00:01:51.512Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-07-16 10:28:37","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"DD248A1D-CACC-4E76-925A-078B736442AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"9B8A0403-0869-495F-B7C0-13A387549C7A"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"39791F43-CF89-485B-AA8B-634C282BB025"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"428E4846-8C9E-4592-8437-88FCDCED704D"},{"vulnerable":true,"criteria":"cpe:2.3:a:moodle:moodle:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"18C6F348-DAE9-4440-8B3A-8D92ADC6606F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"4293","Ordinal":"1","Title":"CVE-2011-4293","CVE":"CVE-2011-4293","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"4293","Ordinal":"1","NoteData":"The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors.","Type":"Description","Title":"CVE-2011-4293"},{"CveYear":"2011","CveId":"4293","Ordinal":"2","NoteData":"2012-07-16","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"4293","Ordinal":"3","NoteData":"2012-07-25","Type":"Other","Title":"Modified"}]}}}