Moodle Multiple Vulnerabilities

Bugtraq ID:	40944
Class:	Unknown
CVE:	CVE-2010-2228 CVE-2010-2229 CVE-2010-2230 CVE-2010-2231
Remote:	Yes
Local:	No
Published:	Jun 17 2010 12:00AM
Updated:	May 07 2015 05:09PM
Credit:	Petr Skoda,Emmanuel Bouillon,Sascha Herzog
Vulnerable:	S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Moodle moodle 1.9.8 Moodle moodle 1.9.7 Moodle moodle 1.9.6 Moodle moodle 1.9.4 Moodle moodle 1.9.3 Moodle moodle 1.9.2 Moodle moodle 1.8.11 Moodle moodle 1.8.10 Moodle moodle 1.8.9 Moodle moodle 1.8.9 Moodle moodle 1.8.8 Moodle moodle 1.8.7 Moodle moodle 1.8.6 Moodle moodle 1.8.5 Moodle moodle 1.8.4 Moodle moodle 1.8.3 Moodle moodle 1.8.2 Moodle moodle 1.7.7 Moodle moodle 1.7.6 Moodle moodle 1.7.5 Moodle moodle 1.7.4 Moodle moodle 1.7.3 Moodle moodle 1.7.2 Moodle moodle 1.7.1 Moodle moodle 1.6.9 Moodle moodle 1.6.8 Moodle moodle 1.6.7 Moodle moodle 1.6.6 Moodle moodle 1.6.5 Moodle moodle 1.6.4 Moodle moodle 1.6.3 Moodle moodle 1.6.2 Moodle moodle 1.6.1 Moodle moodle 1.6 dev Moodle moodle 1.6 Moodle moodle 1.5.2 Moodle moodle 1.5.1 Moodle moodle 1.5 Moodle moodle 1.4.3 Moodle moodle 1.4.2 Moodle moodle 1.4.1 Moodle moodle 1.3.4 Moodle moodle 1.3.3 Moodle moodle 1.3.2 Moodle moodle 1.3.1 Moodle moodle 1.3 Moodle moodle 1.2.1 Moodle moodle 1.2 Moodle moodle 1.1.1 Moodle moodle 1.9 Moodle moodle 1.7.7+ Moodle moodle 1.7 Moodle moodle 1.6.9+ Moodle moodle 1.6.1 + Moodle moodle 1.18.2.3 Moodle moodle 1.18.2.2 Moodle moodle 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 BEA Systems Weblogic Proxy Plugin 1.5.3 + BEA Systems Weblogic Proxy Plugin 1.5.3
Not Vulnerable:	Moodle moodle 1.9.9 Moodle moodle 1.8.13

Moodle Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities, including:

- a cross-site scripting issue
- a security-bypass issue
- an HTML-injection issue

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

These issues affect versions prior to Moodle 1.9.9 and 1.8.13.

Moodle Multiple Vulnerabilities

An attacker can use a browser to exploit these issues. In some cases, the attacker entices an unsuspecting user into following a malicious URI.

Moodle Multiple Vulnerabilities

References:

• Moodle Homepage (Moodle)
  
• Moodle Security (Moodle)
  
• MSA-10-0010 (Moodle)
  
• MSA-10-0011 (Moodle)
  
• MSA-10-0012 (Moodle)
  
• MSA-10-0013 (Moodle)