Description
The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | moodle/moodle | >= 2.3, < 2.3.3 | 2.3.3 | GHSA-mpjx-8phj-5m34 |
| Packagist | moodle/moodle | >= 2.2, < 2.2.6 | 2.2.6 | GHSA-mpjx-8phj-5m34 |
| Packagist | moodle/moodle | >= 2.1, < 2.1.9 | 2.1.9 | GHSA-mpjx-8phj-5m34 |