theme/yui_combo.php in Moodle 2.3.x prior to 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote malicious users to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
moodle moodle 2.3.0 |
||
moodle moodle 2.3.1 |
Vulmon