SB2014032404 - Multiple vulnerabilities in Moodle 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014032404

SB2014032404 - Multiple vulnerabilities in Moodle

Published: March 24, 2014 Updated: January 16, 2023

Security Bulletin ID SB2014032404
Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 22% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0122)

The vulnerability allows a remote #AU# to read and manipulate data.

mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0123)

The vulnerability allows a remote #AU# to read and manipulate data.

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to reach the individual wiki of an arbitrary student.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0124)

The vulnerability allows a remote #AU# to gain access to sensitive information.

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain sensitive information by using the (1) Forum or (2) Quiz module.


4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0125)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.


5) Cross-site request forgery (CVE-ID: CVE-2014-0126)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0127)

The vulnerability allows a remote #AU# to read and manipulate data.

The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restrictions on starting a Feedback activity by choosing an unavailable time.


7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-0129)

The vulnerability allows a remote #AU# to manipulate data.

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.


8) Cross-site scripting (CVE-ID: CVE-2014-2571)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-2572)

The vulnerability allows a remote #AU# to manipulate data.

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.


Remediation

Install update from vendor's website.

References