Moodle Multiple Security Vulnerabilities

Bugtraq ID:	55565
Class:	Unknown
CVE:	CVE-2012-4400 CVE-2012-4401 CVE-2012-4407 CVE-2012-4408 CVE-2012-4402 CVE-2012-4403
Remote:	Yes
Local:	No
Published:	Sep 17 2012 12:00AM
Updated:	Apr 13 2015 09:52PM
Credit:	Andrew Davis, Alexander Bias, Kyle Decot, Rex Lorenzo, Nathan Mares, Mark Baseggio
Vulnerable:	Moodle Moodle 2.3.1 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.7 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.3 Moodle Moodle 2.2 Moodle Moodle 2.1.3 Moodle Moodle 2.1
Not Vulnerable:	Moodle Moodle 2.3.2 Moodle Moodle 2.2.5 Moodle Moodle 2.1.8

Moodle Multiple Security Vulnerabilities

Moodle is prone to multiple security vulnerabilities, including:

1. Multiple security-bypass vulnerabilities
2. An information-disclosure vulnerability
3. An arbitrary file-access vulnerability

Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, view the contents of arbitrary files, or gain read/write access to arbitrary files in the context of the web server process. Other attacks may also be possible.

Moodle Multiple Security Vulnerabilities

Attackers can exploit these issues using a browser.

Moodle Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Moodle Multiple Security Vulnerabilities

References:

• Moodle Homepage (Moodle)
  
• MSA-12-0051: File upload size constraint issue (Andrew Davis)
  
• MSA-12-0052: Course topics permission issue (Alexander Bias)
  
• MSA-12-0053: Blog file access issue (Kyle Decot)
  
• MSA-12-0054: Course reset permission issue (Rex Lorenzo)
  
• MSA-12-0055: Web service access token issue (Nathan Mares)
  
• MSA-12-0056: Information leak in drag-and-drop (Mark Baseggio)