The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.

Several remote vulnerabilities have been discovered in Moodle, a course management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-1613     Moodle does not enable the 'Regenerate session id during     login' setting by default, which makes it easier for     remote attackers to conduct session fixation attacks.

  - CVE-2010-1614     Multiple cross-site scripting (XSS) vulnerabilities     allow remote attackers to inject arbitrary web script or     HTML via vectors related to (1) the Login-As feature or     (2) when the global search feature is enabled,     unspecified global search forms in the Global Search     Engine.

  - CVE-2010-1615     Multiple SQL injection vulnerabilities allow remote     attackers to execute arbitrary SQL commands via vectors     related to (1) the add_to_log function in     mod/wiki/view.php in the wiki module, or (2) 'data     validation in some forms elements' related to     lib/form/selectgroups.php.

  - CVE-2010-1616     Moodle can create new roles when restoring a course,     which allows teachers to create new accounts even if     they do not have the moodle/user:create capability.

  - CVE-2010-1617     user/view.php does not properly check a role, which     allows remote authenticated users to obtain the full     names of other users via the course profile page.

  - CVE-2010-1618     A Cross-site scripting (XSS) vulnerability in the phpCAS     client library allows remote attackers to inject     arbitrary web script or HTML via a crafted URL, which is     not properly handled in an error message.

  - CVE-2010-1619     A Cross-site scripting (XSS) vulnerability in the     fix_non_standard_entities function in the KSES HTML text     cleaning library (weblib.php) allows remote attackers to     inject arbitrary web script or HTML via crafted HTML     entities.

  - CVE-2010-2228     A Cross-site scripting (XSS) vulnerability in the MNET     access-control interface allows remote attackers to     inject arbitrary web script or HTML via vectors     involving extended characters in a username.

  - CVE-2010-2229     Multiple cross-site scripting (XSS) vulnerabilities in     blog/index.php allow remote attackers to inject     arbitrary web script or HTML via unspecified parameters.

  - CVE-2010-2230     The KSES text cleaning filter in lib/weblib.php does not     properly handle vbscript URIs, which allows remote     authenticated users to conduct cross-site scripting     (XSS) attacks via HTML input.

  - CVE-2010-2231     A Cross-site request forgery (CSRF) vulnerability in     report/overview/report.php in the quiz module allows     remote attackers to hijack the authentication of     arbitrary users for requests that delete quiz attempts     via the attemptid parameter.

Moodle was prone to several Cross-Site Scripting (XSS) vulnerabilities (CVE-2010-2228, CVE-2010-2229, CVE-2010-2230, CVE-2010-2231).

Moodle upstream has released v1.9.9 and v1.8.13:
http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://docs.moodle.org/en/Moodle_1.8.13_release_notes Which address the following issues: * MSA-10-0010 Persistent Cross Site Scripting vulnerability in the MNET access control interface * MSA-10-0011 Cross Site Scripting vulnerability in blog/index.php * MSA-10-0012 KSES Security Filter Bypassing vulnerability * MSA-10-0013 Potential Cross Site Scripting vulnerability in Quiz reports

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle prior to 1.8.13 or 1.9.9 are potentially affected by multiple vulnerabilities :

  - A persistent cross-site scripting vulnerability in the MNET access control interface. (MSA-10-0010)

  - A cross-site scripting vulnerability in 'blog/index.php'. (MSA-10-0011)

  - The KSES text cleaning filter may allow registered users to launch persistent cross-site scripting attacks. (MSA-10-012)

  - A potential cross-site request forgery vulnerability exists in Quiz reports. (MSA-10-013)

ID	Name	Product	Family	Severity
49717	Debian DSA-2115-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	high
47707	openSUSE Security Update : moodle (openSUSE-SU-2010:0365-1)	Nessus	SuSE Local Security Checks	medium
47706	openSUSE Security Update : moodle (openSUSE-SU-2010:0365-1)	Nessus	SuSE Local Security Checks	medium
47221	Fedora 11 : moodle-1.9.9-1.fc11 (2010-10321)	Nessus	Fedora Local Security Checks	medium
47220	Fedora 13 : moodle-1.9.9-1.fc13 (2010-10291)	Nessus	Fedora Local Security Checks	medium
47219	Fedora 12 : moodle-1.9.9-1.fc12 (2010-10286)	Nessus	Fedora Local Security Checks	medium
5575	Moodle < 1.8.13 / 1.9.x < 1.9.9 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2010-2230

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

high