Moodle Multiple Security Vulnerabilities
BID:54481
Info
Moodle Multiple Security Vulnerabilities
| Bugtraq ID: | 54481 |
| Class: | Unknown |
| CVE: |
CVE-2012-3387 CVE-2012-3388 CVE-2012-3389 CVE-2012-3390 CVE-2012-3391 CVE-2012-3392 CVE-2012-3393 CVE-2012-3394 CVE-2012-3395 CVE-2012-3396 CVE-2012-3397 CVE-2012-3398 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 17 2012 12:00AM |
| Updated: | May 07 2015 05:13PM |
| Credit: | Petr .koda, Dan Poltawski, Juan Leyva, Andrew Nicols, Andrew Davis, Daniel Compton, Christophe, Dan Marsden, Eugene, Luke Tucker and Serin Terrier |
| Vulnerable: |
Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.0.9 Moodle Moodle 2.0.8 Moodle Moodle 2.0.7 Moodle Moodle 2.0.5 Moodle Moodle 2.0.4 Moodle Moodle 2.0.3 Moodle Moodle 2.0.2 Moodle Moodle 2.0.1 Moodle Moodle 2.0.1 Moodle Moodle 2.2.3+ Moodle Moodle 2.2.2+ Moodle Moodle 2.2 Moodle Moodle 2.1.6+ Moodle Moodle 2.1.5+ Moodle Moodle 2.1.3 Moodle Moodle 2.1 Moodle Moodle 2.0.8+ Moodle Moodle 2.0.6 Moodle Moodle 2.0 Moodle Moodle 1.9 Moodle moodle 1.6.9+ |
| Not Vulnerable: |
Moodle Moodle 2.3.1 Moodle Moodle 2.2.4 Moodle Moodle 2.1.7 Moodle Moodle 2.0.10 |
Discussion
Moodle Multiple Security Vulnerabilities
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities
2. A URI-redirection vulnerability
3. An information-disclosure vulnerability
4. A denial-of-service vulnerability
5. An HTML-injection vulnerability
6. Multiple unspecified vulnerabilities
7. Multiple cross-site scripting vulnerabilities
8. An arbitrary file-upload vulnerability
9. An arbitrary file-access vulnerability
10. An SQL-injection vulnerability
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, bypass the authentication mechanism, inject information in HTTP request headers, and influence how Web content is served, cached, or interpreted. Other attacks may also be possible.
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities
2. A URI-redirection vulnerability
3. An information-disclosure vulnerability
4. A denial-of-service vulnerability
5. An HTML-injection vulnerability
6. Multiple unspecified vulnerabilities
7. Multiple cross-site scripting vulnerabilities
8. An arbitrary file-upload vulnerability
9. An arbitrary file-access vulnerability
10. An SQL-injection vulnerability
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, bypass the authentication mechanism, inject information in HTTP request headers, and influence how Web content is served, cached, or interpreted. Other attacks may also be possible.
Exploit / POC
Moodle Multiple Security Vulnerabilities
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, bypass the authentication mechanism, inject information in HTTP request headers, and influence how Web content is served, cached, or interpreted. Other attacks may also be possible.
Attackers can exploit these issues to bypass certain security restrictions, redirect users to an attacker-controlled site, obtain sensitive information, upload arbitrary files, perform a denial-of-service attack, bypass the authentication mechanism, inject information in HTTP request headers, and influence how Web content is served, cached, or interpreted. Other attacks may also be possible.
Solution / Fix
Moodle Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.