CVE-2011-4203 Moodle CRLF Injection Vulnerability in Calendar Component

Medium 5.0 Published 22 Dec 2011 Updated 17 Sep 2024

Remote attackers can inject HTTP headers and split responses in Moodle Calendar via the url variable, potentially bypassing security controls.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-4203?

CVE-2011-4203 is a medium-severity vulnerability in Moodle Moodle, published on 22 Dec 2011. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.

Weakness: CWE-94

Which versions are affected by CVE-2011-4203?

6 open source packages ship an affected version, including moodle/moodle. It affects 1 product.

Package	Affected	Fixed in
`moodle/moodle` Packagist	All versions	`1.9.15`
`moodle/moodle` Packagist	All versions	`1.9.15`
`moodle/moodle` Packagist	From `2.0`	`2.0.6`
`moodle/moodle` Packagist	From `2.0`	`2.0.6`
`moodle/moodle` Packagist	From `2.1`	`2.1.3`
`moodle/moodle` Packagist	From `2.1`	`2.1.3`

Products include Moodle Moodle.

How do I fix CVE-2011-4203?

Upgrade moodle/moodle to a fixed version for your release line: 1.9.15, 2.0.6 or 2.1.3.

Is CVE-2011-4203 being exploited?

There is no known exploitation of CVE-2011-4203 in the wild and no public exploit code.

All Moodle Moodle vulnerabilities

Sources

Also known as GHSA-4w8m-96v9-2c86, UBUNTU-CVE-2011-4203.