SB2015032409 - Fedora 21 update for moodle
Published: March 24, 2015 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2015-1493)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3. A remote authenticated user can send a specially crafted HTTP request and remote authenticated users to read arbitrary files via a . (dot dot) in the file parameter, as demonstrated by reading PHP scripts.
2) Cross-site scripting (CVE-ID: CVE-2015-2269)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data when processing data passed via a (1) alt or (2) title attribute in an IMG element. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Resource management error (CVE-ID: CVE-2015-2268)
The vulnerability allows a remote #AU# to perform a denial of service (DoS) attack.
filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
4) Improper access control (CVE-ID: CVE-2015-2267)
The vulnerability allows a remote #AU# to manipulate data.
mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.
5) Information disclosure (CVE-ID: CVE-2015-2266)
The vulnerability allows a remote #AU# to gain access to sensitive information.
message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-2272)
The vulnerability allows a remote #AU# to manipulate data.
login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.
7) Cross-site scripting (CVE-ID: CVE-2015-2273)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
8) Input validation error (CVE-ID: CVE-2015-2270)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2015-2271)
The vulnerability allows a remote #AU# to manipulate data.
tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature.
Remediation
Install update from vendor's website.