Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Moodle assignment comments can be read or changed remotely

CVE-2012-6102 · published 13 years ago
Summary

The comments feature in Moodle's Assignment module (versions 2.3 before 2.3.4 and 2.4 before 2.4.1) can be accessed by anyone with a specially crafted link. This lets an attacker view or edit feedback comments for any student without permission. Update Moodle to the latest release or apply the provided security patch to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
moodle moodle 2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
cpe:2.3:a:moodle:moodle:2.3.0:*:*:*:*:*:*:*
Original advisory text
lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedbac...
lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments (aka feedback comments) of arbitrary users via a crafted URI.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published27 Jan 2013
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-6102 · NVD
Track software like this
Free during beta