Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.

Latest upstreams, multiple security fixes.

Name: CVE-2013-6780 URL:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6780 Assigned:
20131112 Reference:
https://yuilibrary.com/support/20131111-vulnerability/

Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.

Name: CVE-2013-3630 URL:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3630 [Open'>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3630'>Op en URL] Assigned: 20130521 Reference:
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seve n-foss-disclosures-part-one [Open'>https://community.rapid7.com/community/metasploit/blog/2013/10/ 30/seven-foss-disclosures-part-one'>Open URL] Reference:
https://community.rapid7.com/community/metasploit/blog/2013/10/30/seve n-tricks-and-treats [Open'>https://community.rapid7.com/community/metasploit/blog/2013/10/ 30/seven-tricks-and-treats'>Open URL]

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
71066	Fedora 19 : moodle-2.4.7-1.fc19 (2013-21397)	Nessus	Fedora Local Security Checks	medium
71065	Fedora 18 : moodle-2.3.10-1.fc18 (2013-21354)	Nessus	Fedora Local Security Checks	medium
71063	Fedora 20 : moodle-2.5.3-1.fc20 (2013-21312)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-3630

high

Tenable Plugins

medium

medium

medium