SB2012071604 - Multiple vulnerabilities in Moodle 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012071604

SB2012071604 - Multiple vulnerabilities in Moodle

Published: July 16, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012071604
Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-4287)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-4288)

The vulnerability allows a remote #AU# to gain access to sensitive information.

Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-4289)

The vulnerability allows a remote #AU# to gain access to sensitive information.

Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.


4) Input validation error (CVE-ID: CVE-2011-4291)

The vulnerability allows a remote #AU# to perform service disruption.

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted ratings operations.


5) SQL injection (CVE-ID: CVE-2011-4292)

The vulnerability allows a remote #AU# to perform service disruption.

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted comments operations.


Remediation

Install update from vendor's website.

References