Moodle 'lib.php' Arbitrary File Disclosure Vulnerability

Bugtraq ID:	57627
Class:	Input Validation Error
CVE:	CVE-2012-6099
Remote:	Yes
Local:	No
Published:	Jan 27 2013 12:00AM
Updated:	Jan 27 2013 12:00AM
Credit:	Dan Poltawski
Vulnerable:	Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.9 Moodle Moodle 2.1.8 Moodle Moodle 2.1.7 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.4 Moodle Moodle 2.3 Moodle Moodle 2.2 Moodle Moodle 2.1.3 Moodle Moodle 2.1
Not Vulnerable:	Moodle Moodle 2.4.1 Moodle Moodle 2.3.4 Moodle Moodle 2.2.7 Moodle Moodle 2.1.10

Moodle 'lib.php' Arbitrary File Disclosure Vulnerability

Moodle is prone to a vulnerability that lets attacker access arbitrary files because it fails to adequately validate user-supplied input.

An authenticated attacker can exploit this vulnerability to view arbitrary files within the context of the affected application.

The following products are affected:

Moodle 2.1.x versions prior to 2.1.10
Moodle 2.2.x versions prior to 2.2.7
Moodle 2.3.x versions prior to 2.3.4
Moodle 2.4.x versions prior to 2.4.1

Moodle 'lib.php' Arbitrary File Disclosure Vulnerability

An attacker may use readily available tools to exploit this issue.

Moodle 'lib.php' Arbitrary File Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.