The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly support the sendname, sendemailaddr, and acceptgrades settings, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an environment in which there was an ineffective attempt to enable the more secure values.

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.4.x prior to 2.4.5 or 2.5.x prior to 2.5.1 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program failing to properly restrict users using view source on pages.  This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243)
 - A flaw exists that allows a remote cross-site scripting (XSS) attack.  This flaw exists because the application does not validate input passed via the Conditional Activities 'user' field before returning it to the user.  This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. (CVE-2013-2244)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.3.x prior to 2.3.8 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program failing to properly restrict users using view source on pages.  This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.2.x prior to 2.2.11 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

ID	Name	Product	Family	Severity
9417	Moodle 2.4.x < 2.4.5 / 2.5.x < 2.5.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
9416	Moodle 2.3.x < 2.3.8 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
9415	Moodle 2.2.x < 2.2.11 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2013-4938

medium

Tenable Plugins

medium

medium

medium