Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
BID:98463
Info
Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
| Bugtraq ID: | 98463 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-7491 |
| Remote: | Yes |
| Local: | No |
| Published: | May 15 2017 12:00AM |
| Updated: | May 15 2017 12:00AM |
| Credit: | Lukas Schmidt |
| Vulnerable: |
Moodle Moodle 3.1.4 Moodle Moodle 3.1.3 Moodle Moodle 3.1.2 Moodle Moodle 3.1.1 Moodle Moodle 3.0.8 Moodle Moodle 3.0.7 Moodle Moodle 3.0.6 Moodle Moodle 3.0.5 Moodle Moodle 3.0.4 Moodle Moodle 3.0.3 Moodle Moodle 3.0.2 Moodle Moodle 3.0.1 Moodle Moodle 2.7.18 Moodle Moodle 2.7.17 Moodle Moodle 2.7.16 Moodle Moodle 2.7.15 Moodle Moodle 2.7.14 Moodle Moodle 2.7.13 Moodle Moodle 2.7.12 Moodle Moodle 2.7.11 Moodle Moodle 2.7.10 Moodle Moodle 2.7.9 Moodle Moodle 2.7.8 Moodle Moodle 2.7.7 Moodle Moodle 2.7.6 Moodle Moodle 2.7.5 Moodle Moodle 2.7.3 Moodle Moodle 2.7.2 Moodle Moodle 2.6.11 Moodle Moodle 2.6.10 Moodle Moodle 2.6.9 Moodle Moodle 2.6.8 Moodle Moodle 2.6.6 Moodle Moodle 2.6.5 Moodle Moodle 2.6.3 Moodle Moodle 2.6.2 Moodle Moodle 2.6.1 Moodle Moodle 2.5.9 Moodle Moodle 2.5.8 Moodle Moodle 2.5.6 Moodle Moodle 2.5.4 Moodle Moodle 2.5.2 Moodle Moodle 2.5.1 Moodle Moodle 2.4.10 Moodle Moodle 2.4.8 Moodle Moodle 2.4.6 Moodle Moodle 2.4.5 Moodle Moodle 2.4.4 Moodle Moodle 2.4.3 Moodle Moodle 2.3.11 Moodle Moodle 2.3.9 Moodle Moodle 2.3.8 Moodle Moodle 2.3.7 Moodle Moodle 2.3.6 Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.11 Moodle Moodle 2.2.10 Moodle Moodle 2.2.9 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.1.9 Moodle Moodle 2.1.8 Moodle Moodle 2.1.7 Moodle Moodle 2.1.6 Moodle Moodle 2.1.5 Moodle Moodle 2.1.4 Moodle Moodle 2.1.2 Moodle Moodle 2.1.1 Moodle Moodle 2.0.10 Moodle Moodle 2.0.9 Moodle Moodle 2.0.8 Moodle Moodle 2.0.7 Moodle Moodle 2.0.5 Moodle Moodle 2.0.4 Moodle Moodle 2.0.3 Moodle Moodle 2.0.2 Moodle Moodle 2.0.1 Moodle Moodle 1.9.18 Moodle Moodle 1.9.17 Moodle Moodle 1.9.16 Moodle Moodle 1.9.14 Moodle Moodle 1.9.13 Moodle Moodle 1.9.12 Moodle Moodle 1.9.11 Moodle moodle 1.9.10 Moodle moodle 1.9.9 Moodle moodle 1.9.8 Moodle moodle 1.9.7 Moodle moodle 1.9.6 Moodle Moodle 1.9.5 Moodle moodle 1.9.4 Moodle moodle 1.9.3 Moodle moodle 1.9.2 Moodle Moodle 1.9.1 Moodle moodle 1.8.14 Moodle moodle 1.8.13 Moodle moodle 1.8.11 Moodle moodle 1.8.10 Moodle moodle 1.8.9 Moodle moodle 1.8.8 Moodle moodle 1.8.7 Moodle moodle 1.8.6 Moodle moodle 1.8.5 Moodle moodle 1.8.4 Moodle moodle 1.8.3 Moodle moodle 1.8.2 Moodle Moodle 1.8.1 Moodle moodle 1.7.7 Moodle moodle 1.7.6 Moodle moodle 1.7.5 Moodle moodle 1.7.4 Moodle moodle 1.7.3 Moodle moodle 1.7.2 Moodle moodle 1.7.1 Moodle moodle 1.6.9 Moodle moodle 1.6.8 Moodle moodle 1.6.7 Moodle moodle 1.6.6 Moodle moodle 1.6.5 Moodle moodle 1.6.4 Moodle moodle 1.6.3 Moodle moodle 1.6.2 Moodle moodle 1.6.1 Moodle moodle 1.6 Moodle moodle 1.5.2 Moodle moodle 1.5.1 Moodle moodle 1.5 Moodle moodle 1.4.3 Moodle moodle 1.4.2 Moodle moodle 1.4.1 Moodle moodle 1.3.4 Moodle moodle 1.3.3 Moodle moodle 1.3.2 Moodle moodle 1.3.1 Moodle moodle 1.3 Moodle Moodle 1.2.2 Moodle moodle 1.2.1 Moodle moodle 1.2 Moodle moodle 1.1.1 Moodle Moodle 3.2.2 Moodle Moodle 3.2.1 Moodle Moodle 3.2 Moodle Moodle 3.1.5 Moodle Moodle 3.1 Moodle Moodle 3.0.9 Moodle Moodle 3.0 Moodle Moodle 2.8.2 Moodle Moodle 2.8.1 Moodle Moodle 2.8 Moodle Moodle 2.7.4 Moodle Moodle 2.7.19 Moodle Moodle 2.7.1 Moodle Moodle 2.7 Moodle Moodle 2.6.7 Moodle Moodle 2.6.4 Moodle Moodle 2.6 Moodle Moodle 2.5.7 Moodle Moodle 2.5.5 Moodle Moodle 2.5.3 Moodle Moodle 2.5 Moodle Moodle 2.4.9 Moodle Moodle 2.4.7 Moodle Moodle 2.4.2 Moodle Moodle 2.4.11 Moodle Moodle 2.4.1 Moodle Moodle 2.4 Moodle Moodle 2.3.5 Moodle Moodle 2.3.4 Moodle Moodle 2.3.10 Moodle Moodle 2.3 Moodle Moodle 2.2.8 Moodle Moodle 2.2.7 Moodle Moodle 2.2 Moodle Moodle 2.1.3 Moodle Moodle 2.1.10 Moodle Moodle 2.1 Moodle Moodle 2.0.6 Moodle Moodle 2.0 Moodle Moodle 1.9.20 Moodle Moodle 1.9.19 Moodle Moodle 1.9.15 Moodle moodle 1.9 Moodle Moodle 1.8 Moodle moodle 1.7 Moodle Moodle 1.6 Moodle Moodle 1.5 Moodle Moodle 1.4.5 Moodle Moodle 1.4.4 Moodle Moodle 1.3 Moodle moodle 1.18.2.3 Moodle moodle 1.18.2.2 BEA Systems Weblogic Proxy Plugin 1.5.3 |
| Not Vulnerable: |
Moodle Moodle 3.2.3 Moodle Moodle 3.1.6 Moodle Moodle 3.0.10 Moodle Moodle 2.7.20 |
Discussion
Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
Moodle is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Moodle 3.2 through 3.2.2, 3.1 through 3.1.5, 3.0 through 3.0.9, 2.7 through 2.7.19 and other unsupported versions are vulnerable.
Moodle is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
Moodle 3.2 through 3.2.2, 3.1 through 3.1.5, 3.0 through 3.0.9, 2.7 through 2.7.19 and other unsupported versions are vulnerable.
Exploit / POC
Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Moodle CVE-2017-7491 Cross-Site Request Forgery Vulnerability
References:
References: