CVE-2010-2231
Summary
| CVE | CVE-2010-2231 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-06-28 17:30:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Moodle | Moodle | 1.1.1 | All | All | All |
| Application | Moodle | Moodle | 1.2.0 | All | All | All |
| Application | Moodle | Moodle | 1.2.1 | All | All | All |
| Application | Moodle | Moodle | 1.3.0 | All | All | All |
| Application | Moodle | Moodle | 1.3.1 | All | All | All |
| Application | Moodle | Moodle | 1.3.2 | All | All | All |
| Application | Moodle | Moodle | 1.3.3 | All | All | All |
| Application | Moodle | Moodle | 1.3.4 | All | All | All |
| Application | Moodle | Moodle | 1.4.1 | All | All | All |
| Application | Moodle | Moodle | 1.4.2 | All | All | All |
| Application | Moodle | Moodle | 1.4.3 | All | All | All |
| Application | Moodle | Moodle | 1.4.4 | All | All | All |
| Application | Moodle | Moodle | 1.4.5 | All | All | All |
| Application | Moodle | Moodle | 1.5 | All | All | All |
| Application | Moodle | Moodle | 1.5.0 | beta | All | All |
| Application | Moodle | Moodle | 1.5.1 | All | All | All |
| Application | Moodle | Moodle | 1.5.2 | All | All | All |
| Application | Moodle | Moodle | 1.5.3 | All | All | All |
| Application | Moodle | Moodle | 1.6.0 | All | All | All |
| Application | Moodle | Moodle | 1.6.1 | All | All | All |
| Application | Moodle | Moodle | 1.6.2 | All | All | All |
| Application | Moodle | Moodle | 1.6.3 | All | All | All |
| Application | Moodle | Moodle | 1.6.4 | All | All | All |
| Application | Moodle | Moodle | 1.6.5 | All | All | All |
| Application | Moodle | Moodle | 1.6.6 | All | All | All |
| Application | Moodle | Moodle | 1.6.7 | All | All | All |
| Application | Moodle | Moodle | 1.6.8 | All | All | All |
| Application | Moodle | Moodle | 1.7.1 | All | All | All |
| Application | Moodle | Moodle | 1.7.2 | All | All | All |
| Application | Moodle | Moodle | 1.7.3 | All | All | All |
| Application | Moodle | Moodle | 1.7.4 | All | All | All |
| Application | Moodle | Moodle | 1.7.5 | All | All | All |
| Application | Moodle | Moodle | 1.7.6 | All | All | All |
| Application | Moodle | Moodle | 1.8.1 | All | All | All |
| Application | Moodle | Moodle | 1.8.10 | All | All | All |
| Application | Moodle | Moodle | 1.8.11 | All | All | All |
| Application | Moodle | Moodle | 1.8.2 | All | All | All |
| Application | Moodle | Moodle | 1.8.3 | All | All | All |
| Application | Moodle | Moodle | 1.8.4 | All | All | All |
| Application | Moodle | Moodle | 1.8.5 | All | All | All |
| Application | Moodle | Moodle | 1.8.6 | All | All | All |
| Application | Moodle | Moodle | 1.8.7 | All | All | All |
| Application | Moodle | Moodle | 1.8.8 | All | All | All |
| Application | Moodle | Moodle | 1.8.9 | All | All | All |
| Application | Moodle | Moodle | 1.9.1 | All | All | All |
| Application | Moodle | Moodle | 1.9.2 | All | All | All |
| Application | Moodle | Moodle | 1.9.3 | All | All | All |
| Application | Moodle | Moodle | 1.9.4 | All | All | All |
| Application | Moodle | Moodle | 1.9.5 | All | All | All |
| Application | Moodle | Moodle | 1.9.6 | All | All | All |
| Application | Moodle | Moodle | 1.9.7 | All | All | All |
| Application | Moodle | Moodle | 1.9.8 | All | All | All |
| Application | Moodle | Moodle | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [security-announce] SUSE Security Summary Report: SUSE-SR:2010:014 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Moodle 1.8.13 release notes - MoodleDocs | af854a3a-2127-422b-91ae-364da2661108 | docs.moodle.org | |
| oss-security - Re: CVE request: moodle 1.9.9/1.8.13 multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Moodle Multiple Vulnerabilities - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| [SECURITY] Fedora 11 Update: moodle-1.9.9-1.fc11 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Bug 605809 – CVE-2010-2228, CVE-2010-2229, CVE-2010-2230, CVE-2010-2231 moodle: multiple security fixes in upstream 1.9.9/1.8.13 | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| [SECURITY] Fedora 13 Update: moodle-1.9.9-1.fc13 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [moodle] Diff of /moodle/mod/quiz/report/overview/report.php | af854a3a-2127-422b-91ae-364da2661108 | cvs.moodle.org | Patch |
| Login Required - Moodle Tracker | af854a3a-2127-422b-91ae-364da2661108 | tracker.moodle.org | |
| [SECURITY] Fedora 12 Update: moodle-1.9.9-1.fc12 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Fedora update for moodle - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Moodle.org: MSA-10-0013: Potential Cross Site Request Forgery vulnerability in Quiz reports | af854a3a-2127-422b-91ae-364da2661108 | moodle.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Patch, Vendor Advisory |
| Moodle 1.9.9 release notes - MoodleDocs | af854a3a-2127-422b-91ae-364da2661108 | docs.moodle.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.