Moodle < 1.6.2 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 3742

Synopsis

The remote web server is hosting a web application that is vulnerable to multiple attack vectors.

Description

The remote host is running Moodle, an open-source content-management system written in PHP. This version of Moodle is vulnerable to a SQL Injection flaw, a cross-site scripting flaw, and an information disclosure flaw. An attacker exploiting these flaws would only need to be able to send malformed HTTP requests to the server. Successful exploitation would result in arbitrary SQL command execution on the remote database server, code execution within client browsers, or gleaning of information useful in future attacks.

Solution

Upgrade to version 1.6.2 or higher.

Plugin Details

Severity: High

ID: 3742

Family: CGI

Published: 9/14/2006

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:moodle:moodle

Patch Publication Date: 9/12/2006

Vulnerability Publication Date: 9/12/2006

Reference Information

CVE: CVE-2006-4784, CVE-2006-4785, CVE-2006-4786

BID: 19995

Detections

Analytics