Moodle Forum And Quiz Remote Information Disclosure Vulnerability

Bugtraq ID:	66332
Class:	Input Validation Error
CVE:	CVE-2014-0124
Remote:	Yes
Local:	No
Published:	Mar 17 2014 12:00AM
Updated:	Apr 13 2015 09:55PM
Credit:	Maria Torres
Vulnerable:	Moodle Moodle 2.6.1 Moodle Moodle 2.5.4 Moodle Moodle 2.5.2 Moodle Moodle 2.5.1 Moodle Moodle 2.4.8 Moodle Moodle 2.4.6 Moodle Moodle 2.4.5 Moodle Moodle 2.4.4 Moodle Moodle 2.4.3 Moodle Moodle 2.6 Moodle Moodle 2.5.3 Moodle Moodle 2.5 Moodle Moodle 2.4.7 Moodle Moodle 2.4.2 Moodle Moodle 2.4.1 Moodle Moodle 2.4
Not Vulnerable:	Moodle Moodle 2.6.2 Moodle Moodle 2.5.5 Moodle Moodle 2.4.9

Moodle Forum And Quiz Remote Information Disclosure Vulnerability

Moodle is prone to an information-disclosure vulnerability.

Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks.

Moodle versions 2.6 through 2.6.1, 2.5 through 2.5.4, and 2.4 through 2.4.8 are vulnerable.

Moodle Forum And Quiz Remote Information Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

Moodle Forum And Quiz Remote Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle Forum And Quiz Remote Information Disclosure Vulnerability

References:

• Moodle Homepage (Moodle)
  
• MSA-14-0009: Identity information leak in Forum and Quiz (Moodle)