CVE-2012-5472: lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to b...

Security readout for executives and security teams

This Moodle flaw let a logged-in user change a form value that was meant to be fixed, potentially bypassing access restrictions. The public data does not define the exact business action affected, so urgency depends on whether exposed Moodle sites still run the affected 2.2.x or 2.3.x versions. Exposure is likely limited to legacy Moodle deployments running 2.2.x before 2.2.6 or 2.3.x before 2.3.3, especially where authenticated users can access forms whose frozen fields enforce authorization or workflow restrictions. Treat this as a targeted legacy-platform risk. Prioritize remediation if affected Moodle systems remain internet-accessible or support sensitive academic, identity, or administrative workflows. Mitigation focus: Upgrade affected Moodle 2.2.x systems to 2.2.6 or later.; Upgrade affected Moodle 2.3.x systems to 2.3.3 or later.; Review Moodle security guidance linked from the advisory sources..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.