CVE-2012-4403: theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-a...

Security readout for executives and security teams

CVE-2012-4403 is an information disclosure issue in Moodle 2.3.x before 2.3.2. A malformed request for a missing resource could cause Moodle to reveal its server installation path. This is not described as code execution or data theft, but path disclosure can help attackers plan later attacks. Exposure is limited to Moodle 2.3.x installations earlier than 2.3.2, especially internet-facing learning management systems. Organizations not running Moodle, or running later maintained versions, are not indicated as affected by the provided sources. Low urgency unless an affected Moodle 2.3.x system remains internet-facing. Remediate during routine maintenance, but do not ignore it: leaked server paths can reduce attacker effort during follow-on attacks. Mitigation focus: Upgrade affected Moodle 2.3.x systems to 2.3.2 or later, per vendor security notice.; Review Moodle advisory and MDL-35168 commit references for exact vendor guidance.; Reduce unnecessary error detail exposed to unauthenticated users..

Prepared

Jun 27, 2026, 19:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.