RETIRED: Moodle Multiple Remote Security Vulnerabilities
BID:57475
Info
RETIRED: Moodle Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 57475 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 21 2013 12:00AM |
| Updated: | Apr 13 2015 08:44PM |
| Credit: | Petr Skoda, Elena Ivanova, Simon Coggins, Dan Poltawski, Andrew Nicols, Charles Fulton, and David O'Brien |
| Vulnerable: |
Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 1.9.18 Moodle Moodle 1.9.17 Moodle Moodle 1.9.16 Moodle Moodle 1.9.14 Moodle Moodle 1.9.13 Moodle Moodle 1.9.12 Moodle Moodle 1.9.11 Moodle Moodle 1.9.10 Moodle moodle 1.9.10 Moodle Moodle 1.9.9 Moodle Moodle 1.9.8 Moodle Moodle 1.9.6 Moodle Moodle 1.9.4 Moodle moodle 1.9.3 Moodle moodle 1.9.2 Moodle Moodle 1.9.1 Moodle Moodle 2.2.2+ Moodle Moodle 2.2 Moodle Moodle 2.1.5+ Moodle Moodle 2.1.3 Moodle Moodle 2.1 Moodle Moodle 1.9.2 Moodle Moodle 1.9.17+ Moodle Moodle 1.9.15 Moodle moodle 1.9 |
| Not Vulnerable: | |
Discussion
RETIRED: Moodle Multiple Remote Security Vulnerabilities
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities
2. An unspecified security vulnerability
3. Multiple information-disclosure vulnerabilities
4. A cross-site request forgery
5. Multiple URI redirection vulnerabilities
Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, redirect a victim to a potentially malicious site, or perform unauthorized actions. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
60057 Moodle CVE-2012-6098 Security Bypass Vulnerability
60058 Moodle CVE-2012-6101 Multiple URI Redirection Vulnerabilities
60053 Moodle CVE-2012-6102 Information Disclosure Vulnerability
60061 Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability
60055 Moodle CVE-2012-6104 Information Disclosure Vulnerability
60059 Moodle CVE-2012-6106 Security Bypass Vulnerability
60060 Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
Moodle is prone to multiple security vulnerabilities, including:
1. Multiple security-bypass vulnerabilities
2. An unspecified security vulnerability
3. Multiple information-disclosure vulnerabilities
4. A cross-site request forgery
5. Multiple URI redirection vulnerabilities
Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive information, redirect a victim to a potentially malicious site, or perform unauthorized actions. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
60057 Moodle CVE-2012-6098 Security Bypass Vulnerability
60058 Moodle CVE-2012-6101 Multiple URI Redirection Vulnerabilities
60053 Moodle CVE-2012-6102 Information Disclosure Vulnerability
60061 Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability
60055 Moodle CVE-2012-6104 Information Disclosure Vulnerability
60059 Moodle CVE-2012-6106 Security Bypass Vulnerability
60060 Tinymce PHP Spellchecker Plugin 'GoogleSpell.php' Multiple Remote Code Execution Vulnerabilities
Exploit / POC
RETIRED: Moodle Multiple Remote Security Vulnerabilities
An attacker can use a browser to exploit these issues.
An attacker can use a browser to exploit these issues.
Solution / Fix
RETIRED: Moodle Multiple Remote Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.