mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.0.x prior to 2.0.5, or 2.1.x prior to 2.1.2 are exposed to the following vulnerabilities :

  - Multiple cross-site request forgery (CSRF) vulnerabilities in 'mod/wiki/' components that allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data. (MSA-11-0027 / CVE-2011-4298)

  - A cross-site scripting (XSS) vulnerability in 'mod/wiki/pagelib.php' that allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment. (MSA-11-0028 / CVE-2011-4299)

  - An information disclosure flaw exists in the 'file_browser' component because it does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file. (MSA-11-0029 / CVE-2011-4300)

  - A security-bypass flaw exists in the Box.net authentication plugin which was being used prior to OAuth-like authentication in Box.net. (MSA-11-0030)

  - A flaw exists in the forms API that allows form values set as constants to be altered when the user submits the form. (MSA-11-0031 / CVE-2011-4301)

  - A security flaw exists due to incorrect handling of openssl_verify() return codes and exposes the server to remote attacks bypassing validation. (MSA-11-0032 / CVE-2011-4302)

  - A security flaw affects the script 'lib/db/upgrade.php' that does not set the correct 'registration_hubs.secret' value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature. (MSA-11-0033 / CVE-2011-4303)

  - The chat functionality allows remote authenticated users to discover the name of any user via a beep operation. Beeping a user would disclose their full name, this also includes deleted users. (MSA-11-0034 / CVE-2011-4304)

  - The parameter '$CFG->usesid' was added previously to allow simpler access, but this setting is now ignored to remove a security-bypass vulnerability that allowed for cookie-less user sessions. (MSA-11-0035)

  - A cross-site scripting (XSS) vulnerability affects the Wiki. Specifically, this affects the 'section' parameter of the script 'mod/wiki/lang/en/wiki.php'. (MSA-11-0039 / CVE-2011-4307)

  - An information disclosure flaw exists in 'mod/forum/user.php' which exposes user names to any authenticated members, rather than only students or administrators in the same course. (MSA-11-0040 / CVE-2011-4308)

  - A security-bypass flaw allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL. (MSA-11-0041 / CVE-2011-4309)

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle prior to 1.9.14 are exposed to the following vulnerabilities :

  - A flaw exists in the forms API that allows form values set as constants to be altered when the user submits the form. (MSA-11-0031 / CVE-2011-4301)

  - A security flaw exists due to incorrect handling of openssl_verify() return codes and exposes the server to remote attacks bypassing validation. (MSA-11-0032 / CVE-2011-4302)

  - A denial of service vulnerability exists in the script 'message/refresh.php' because users could change the refresh wait time to zero. This results in an unlimited query which could exhaust system resources, denying access to legitimate users. (MSA-11-0036 / CVE-2011-4305)

  - A cross-site scripting (XSS) vulnerability exists due to lack of input sanitization when editing course sections. Specifically, this affects the 'editsection.html' values directly from user input supplied to data_submitted(). (MSA-11-0037 / CVE-2011-4306)

  - An unspecified SQL injection vulnerability exists when using magic quotes in the SQL query. (MSA-11-0038)

  - An information disclosure flaw exists in 'mod/forum/user.php' which exposes user names to any authenticated members, rather than only students or administrators in the same course. (MSA-11-0040 / CVE-2011-4308)

Several security issues have been fixed in Moodle, a course management system for online learning :

  - CVE-2011-4308 / CVE-2012-0792     Rossiani Wijaya discovered an information leak in     mod/forum/user.php.

  - CVE-2011-4584     MNet authentication didn't prevent a user using 'Login     as' from jumping to a remove MNet SSO.

  - CVE-2011-4585     Darragh Enright discovered that the change password form     was send in over plain HTTP even if httpslogin was set     to 'true'.

  - CVE-2011-4586     David Michael Evans and German Sanchez Gances discovered     CRLF injection/HTTP response splitting vulnerabilities     in the Calendar module.

  - CVE-2011-4587     Stephen Mc Guiness discovered empty passwords could be     entered in some circumstances.

  - CVE-2011-4588     Patrick McNeill discovered that IP address restrictions     could be bypassed in MNet.

  - CVE-2012-0796     Simon Coggins discovered that additional information     could be injected into mail headers.

  - CVE-2012-0795     John Ehringer discovered that email addresses were     insufficiently validated.

  - CVE-2012-0794     Rajesh Taneja discovered that cookie encryption used a     fixed key.

  - CVE-2012-0793     Eloy Lafuente discovered that profile images were     insufficiently protected. A new configuration option     'forceloginforprofileimages' was introduced for that.

ID	Name	Product	Family	Severity
8713	Moodle 2.0.x < 2.0.5 / 2.1.x < 2.1.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
8711	Moodle 1.9.x < 1.9.14 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
58172	Debian DSA-2421-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-4308

medium

Tenable Plugins

medium

medium

medium