RETIRED:Moodle Multiple Security Vulnerabilities

Bugtraq ID:	56582
Class:	Unknown
CVE:	CVE-2012-5471 CVE-2012-5472 CVE-2012-5473 CVE-2012-5479 CVE-2012-5480 CVE-2012-5481
Remote:	Yes
Local:	No
Published:	Nov 19 2012 12:00AM
Updated:	Mar 19 2015 09:10AM
Credit:	Alexander Bias, Richard Meyer, Rossiani Wijaya, Cristobal Leiva, Tabitha Roder and Jody Steele
Vulnerable:	Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.1.3
Not Vulnerable:

RETIRED:Moodle Multiple Security Vulnerabilities

Moodle is prone to multiple security vulnerabilities, including:

1. A security-bypass vulnerability
2. A security vulnerability
3. Multiple information-disclosure vulnerabilities
4. A remote code-execution vulnerability

Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, execute arbitrary code in context of the user running the application. Other attacks may also be possible.

RETIRED: This BID is being retired because it is a duplicate of BID 56505 (Moodle Multiple Security Vulnerabilities).

RETIRED:Moodle Multiple Security Vulnerabilities

An attacker can use a browser to exploit these issues.

RETIRED:Moodle Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

RETIRED:Moodle Multiple Security Vulnerabilities

References:

• Moodle Homepage (Moodle)
  
• MSA-12-0062: Information leak in Database activity module (moodle)
  
• MSA-12-0057: Access issue through repository (moodle)
  
• MSA-12-0058: Possible form data manipulation issue (moodle)
  
• MSA-12-0059: Information leak in Database activity module (moodle)
  
• MSA-12-0061: Remote code execution through Portfolio API (moodle)
  
• MSA-12-0063: Information leak in Check Permissions page (moodle)