Moodle Multiple Security Vulnerabilities
BID:50283
Info
Moodle Multiple Security Vulnerabilities
| Bugtraq ID: | 50283 |
| Class: | Unknown |
| CVE: |
CVE-2012-0792 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 19 2011 12:00AM |
| Updated: | Apr 13 2015 08:15PM |
| Credit: | Petr Škoda, Tatsuya Shirai, David Mudrak, Rossiani Wijaya, Aaron Barnes, Colin Campbell, Alex Willen, Ralf Hilgenstock and Xavier Paz |
| Vulnerable: |
Moodle Moodle 2.1.1 Moodle Moodle 2.0.4 Moodle Moodle 2.0.3 Moodle Moodle 2.0.2 Moodle Moodle 2.0.1 Moodle Moodle 2.0.1 Moodle Moodle 1.9.13 Moodle Moodle 1.9.12 Moodle Moodle 1.9.11 Moodle Moodle 1.9.10 Moodle moodle 1.9.9 Moodle moodle 1.9.8 Moodle Moodle 1.9.7 Moodle moodle 1.9.6 Moodle Moodle 1.9.5 Moodle moodle 1.9.4 Moodle moodle 1.9.3 Moodle Moodle 1.9.1 Moodle Moodle 2.1 Moodle Moodle 2.0 Moodle Moodle 1.9.2 Moodle Moodle 1.9 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Moodle Moodle 2.1.2 Moodle Moodle 2.0.5 Moodle Moodle 1.9.14 |
Discussion
Moodle Multiple Security Vulnerabilities
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities.
2. Multiple cross-site scripting and cross-site request forgery vulnerabilities.
3. Multiple information-disclosure vulnerabilities.
4. A denial of service vulnerability.
5. A data manipulation vulnerability.
6. An SQL injection vulnerability.
Attackers can exploit these issues to bypass certain security restrictions, insert malicious HTML and script codes, obtain sensitive information, compromise a denial of service attack, and modify the logic of SQL queries. Other attacks may also be possible.
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities.
2. Multiple cross-site scripting and cross-site request forgery vulnerabilities.
3. Multiple information-disclosure vulnerabilities.
4. A denial of service vulnerability.
5. A data manipulation vulnerability.
6. An SQL injection vulnerability.
Attackers can exploit these issues to bypass certain security restrictions, insert malicious HTML and script codes, obtain sensitive information, compromise a denial of service attack, and modify the logic of SQL queries. Other attacks may also be possible.
Exploit / POC
Moodle Multiple Security Vulnerabilities
An attacker can use a browser to exploit these issues. In some cases, the attacker entices an unsuspecting user to follow a malicious URI.
An attacker can use a browser to exploit these issues. In some cases, the attacker entices an unsuspecting user to follow a malicious URI.
Solution / Fix
Moodle Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Moodle Multiple Security Vulnerabilities
References:
References:
- Moodle Homepage (Moodle)
- MSA-11-0027 (moodle)
- MSA-11-0028 (moodle)
- MSA-11-0029 (moodle)
- MSA-11-0030 (moodle)
- MSA-11-0031 (moodle)
- MSA-11-0032 (moodle)
- MSA-11-0033 (moodle)
- MSA-11-0034 (moodle)
- MSA-11-0035 (moodle)
- MSA-11-0036 (moodle)
- MSA-11-0037 (moodle)
- MSA-11-0038 (moodle)
- MSA-11-0039 (moodle)
- MSA-11-0040 (moodle)
- MSA-11-0041 (moodle)