Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability

Bugtraq ID:	60061
Class:	Input Validation Error
CVE:	CVE-2012-6103
Remote:	Yes
Local:	No
Published:	Jan 21 2013 12:00AM
Updated:	Jan 21 2013 12:00AM
Credit:	Andrew Nicols
Vulnerable:	Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.10 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.4 Moodle Moodle 2.3 Moodle Moodle 2.2
Not Vulnerable:	Moodle Moodle 2.4.1 Moodle Moodle 2.3.4 Moodle Moodle 2.2.7

Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability

Moodle is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Note: This issue was previously discussed in BID 57475 (Moodle Multiple Remote Security Vulnerabilities), but has been moved to its own record for better documentation.

Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Moodle CVE-2012-6103 Cross Site Request Forgery Vulnerability

References:

• Moodle 2.4.1, 2.3.4, 2.2.7 and 2.1.10 are now available (Moodle)
  
• Moodle Homepage (Moodle)
  
• MSA-13-0007: Potential exploit in messaging (Moodle)