Vulnerability Name:

CVE-2011-4203 (CCN-71690)

Assigned:2011-12-06
Published:2011-12-06
Updated:2020-12-01
Summary:CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2011-4203

Source: CCN
Type: Moodle Web Site
Moodle.org: open-source community-based tools for learning

Source: CCN
Type: MSA-11-0047
Possible injection attack in Calendar

Source: CCN
Type: Pentura Labs's Blog, December 13, 2011
Advisory: CRLF Injection Vulnerability in Moodle

Source: MISC
Type: Exploit
http://penturalabs.wordpress.com/2011/12/13/advisory-crlf-injection-vulnerability-in-moodle/

Source: CCN
Type: SA47076
Moodle Multiple Vulnerabilities

Source: CCN
Type: SA47103
Moodle Multiple Vulnerabilities

Source: MISC
Type: UNKNOWN
http://tracker.moodle.org/browse/MDL-24808

Source: CCN
Type: OSVDB ID: 77503
Moodle calendar/set.php HTTP Request Header Injection

Source: CCN
Type: BID-50923
Moodle Multiple Security Vulnerabilities

Source: CCN
Type: BID-51264
Moodle '/calendar/set.php' HTTP Response Splitting Vulnerability

Source: XF
Type: UNKNOWN
moodle-set-http-response-splitting(71690)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:moodle:moodle:1.9.8:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.12:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.13:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.11:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.14:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:moodle:moodle:1.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.6:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.7:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.10:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.11:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.8:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.9:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.12:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.13:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:1.9.14:*:*:*:*:*:*:*
  • OR cpe:/a:moodle:moodle:2.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.bionic:def:201142030000000
    V
    		CVE-2011-4203 on Ubuntu 18.04 LTS (bionic) - medium.
    2011-12-22
    oval:com.ubuntu.artful:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 17.10 (artful) - medium.
    2011-12-22
    oval:com.ubuntu.trusty:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 14.04 LTS (trusty) - medium.
    2011-12-22
    oval:com.ubuntu.xenial:def:201142030000000
    V
    		CVE-2011-4203 on Ubuntu 16.04 LTS (xenial) - medium.
    2011-12-22
    oval:com.ubuntu.bionic:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 18.04 LTS (bionic) - medium.
    2011-12-22
    oval:com.ubuntu.xenial:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 16.04 LTS (xenial) - medium.
    2011-12-22
    oval:com.ubuntu.disco:def:201142030000000
    V
    		CVE-2011-4203 on Ubuntu 19.04 (disco) - medium.
    2011-12-22
    oval:com.ubuntu.cosmic:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 18.10 (cosmic) - medium.
    2011-12-22
    oval:com.ubuntu.cosmic:def:201142030000000
    V
    		CVE-2011-4203 on Ubuntu 18.10 (cosmic) - medium.
    2011-12-22
    oval:com.ubuntu.precise:def:20114203000
    V
    		CVE-2011-4203 on Ubuntu 12.04 LTS (precise) - medium.
    2011-12-22
    BACK
    moodle moodle 1.9.8
    moodle moodle 1.9.9
    moodle moodle 1.9.12
    moodle moodle 1.9.13
    moodle moodle 1.9.1
    moodle moodle 1.9.4
    moodle moodle 1.9.6
    moodle moodle 2.0.0
    moodle moodle 2.0.2
    moodle moodle 2.2.0
    moodle moodle 1.9.10
    moodle moodle 1.9.11
    moodle moodle 1.9.2
    moodle moodle 1.9.3
    moodle moodle 2.0.3
    moodle moodle 2.0.4
    moodle moodle 2.0.5
    moodle moodle 2.1.0
    moodle moodle 2.1.1
    moodle moodle 1.9.5
    moodle moodle 1.9.7
    moodle moodle 1.9.14
    moodle moodle 2.0.1
    moodle moodle 2.1.2
    moodle moodle 1.9.2
    moodle moodle 1.9.1
    moodle moodle 1.9
    moodle moodle 1.9.3
    moodle moodle 1.9.4
    moodle moodle 1.9.6
    moodle moodle 1.9.5
    moodle moodle 1.9.7
    moodle moodle 1.9.10
    moodle moodle 1.9.11
    moodle moodle 1.9.8
    moodle moodle 1.9.9
    moodle moodle 2.0
    moodle moodle 2.1
    moodle moodle 2.0.1
    moodle moodle 2.0.2
    moodle moodle 2.0.3
    moodle moodle 2.0.4
    moodle moodle 2.1.1
    moodle moodle 1.9.12
    moodle moodle 1.9.13
    moodle moodle 2.1.2
    moodle moodle 2.0.5
    moodle moodle 1.9.14
    moodle moodle 2.2