CVE-2012-3397

no score yetEPSS 1.1%

lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining whether an activity is unavailable or hidden, which allows remote authenticated users to bypass intended access restrictions by selecting an activity that is configured for a group of other users.

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2012-07-23
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

moodle:moodle

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33466
http://openwall.com/lists/oss-security/2012/07/17/1
http://secunia.com/advisories/49890
http://www.securityfocus.com/bid/54481
https://exchange.xforce.ibmcloud.com/vulnerabilities/76963

Check your stack JSON