| Package | Affected versions | Patched versions |
|---|---|---|
| moodle | = 2.3.0= 2.3.1 |
theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free