repository/s3/S3.php in the Amazon S3 library in Moodle up to and including 2.2.11, 2.3.x prior to 2.3.9, 2.4.x prior to 2.4.6, and 2.5.x prior to 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle malicious users to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
moodle moodle 2.5.0 |
||
moodle moodle 2.3.0 |
||
moodle moodle 2.3.1 |
||
moodle moodle 2.3.8 |
||
moodle moodle 2.2.0 |
||
moodle moodle 2.2.5 |
||
moodle moodle 2.2.6 |
||
moodle moodle 2.2.7 |
||
moodle moodle 2.5.1 |
||
moodle moodle 2.4.0 |
||
moodle moodle 2.4.1 |
||
moodle moodle 2.3.2 |
||
moodle moodle 2.3.3 |
||
moodle moodle 2.2.1 |
||
moodle moodle 2.2.10 |
||
moodle moodle 2.2.8 |
||
moodle moodle 2.2.9 |
||
moodle moodle 2.4.2 |
||
moodle moodle 2.4.3 |
||
moodle moodle 2.3.4 |
||
moodle moodle 2.3.5 |
||
moodle moodle |
||
moodle moodle 2.2.2 |
||
moodle moodle 2.4.4 |
||
moodle moodle 2.4.5 |
||
moodle moodle 2.3.6 |
||
moodle moodle 2.3.7 |
||
moodle moodle 2.2.3 |
||
moodle moodle 2.2.4 |
Vulmon