repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.3.x prior to 2.3.2 are exposed to the following vulnerabilities :

 - A flaw exists that may allow a remote attacker to manipulate parameters for the 'repository/repository_ajax.php script'.  This will allow the attacker to bypass restrictions and upload a file that is larger than the allotted size. (CVE-2012-4400)
 - A flaw exists that is triggered when the application fails to properly restrict access to certain topic functions.  This may allow a remote attacker to show or hide topics, as well as set a current topic. (CVE-2012-4401)
 - A flaw exists that is triggered when the 'webservice/lib.php' script fails to properly limit tokens to the service that issued them.  This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when a remote attacker creates a malformed request for the 'yui_combo.php' script, which discloses the software's installation path resulting in a loss of confidentiality.  While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks. (CVE-2012-4403)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when the 'lib/filelib.php' script does not properly check the publication state of blog files.  This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
 - A flaw exists when permissions are not properly verified on the reset page.  This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.2.x prior to 2.2.5 are exposed to the following vulnerabilities :

 - A flaw exists that may allow a remote attacker to manipulate parameters for the 'repository/repository_ajax.php' script.  This will allow the attacker to bypass restrictions and upload a file that is larger than the allotted size. (CVE-2012-4400)
 - A flaw exists that is triggered when the application fails to properly restrict access to certain topic functions. This may allow a remote attacker to show or hide topics, as well as set a current topic. (CVE-2012-4401)
 - A flaw exists that is triggered when the 'webservice/lib.php' script fails to properly limit tokens to the service that issued them.  This may allow a remote attacker to use a token intended for one service to gain access to arbitrary other external services. (CVE-2012-4402)
 - A flaw exists that may lead to an unauthorized information disclosure.  The issue is triggered when the 'lib/filelib.php' script does not properly check the publication state of blog files.  This may allow a remote attacker to gain access to the embedded files of the blog before it is published. (CVE-2012-4407)
 - A flaw exists when permissions are not properly verified on the reset page.  This may allow a remote attacker to reset a course via the reset page. (CVE-2012-4408)

Multiple vulnerabilities.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
9409	Moodle 2.3.x < 2.3.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
9408	Moodle 2.2.x < 2.2.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
62338	Fedora 17 : moodle-2.2.5-1.fc17 (2012-14348)	Nessus	Fedora Local Security Checks	medium
62337	Fedora 16 : moodle-2.1.8-1.fc16 (2012-14295)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4400

medium

Tenable Plugins

medium

medium

medium

medium