Detections
Analytics

Moodle < 1.8.12 / 1.9.x < 1.9.8 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 5504

Synopsis

The remote web server is hosting a web application that is vulnerable to multiple attack vectors.

Description

The version of Moodle installed on the remote host is potentially vulnerable to multiple flaws.

 - Multiple unspecified cross-site scripting vulnerabilities in the KSES text cleaning library. (MSA-10-0001)

 - A cross-site scripting vulnerability exists in the PHP CAS client library. Note that this only affects Moodle installations that use CAS authentication. (MSA-10-0002)

 - An issue exists in the course profile page which allows ordinary users to find out the names of other users. (MSA-10-0003)

 - The restoring of courses sometimes results in creation of new roles. (MSA-10-0004)

 - A SQL injection vulnerability exists in several forms. (MSA-10-0005)

 - Data passed to the 'add_to_log()' function in the wiki module is not properly sanitized which could allow SQL injection attacks. (MSA-10-0006)

 - A problem exists in the handling of user submitted data in global search forms. (MSA-10-0007)

 - A persistent cross-site scripting issue exists when an admin uses the Login-as feature. (MSA-10-0008)

 - The 'Regenerate session id during login' setting is not enabled by default. (MSA-10-0009)

Solution

Upgrade to Moodle version 1.8.12, 1.9.8, or later.

See Also

http://moodle.org/security

http://docs.moodle.org/en/Moodle_1.9.8_release_notes

http://docs.moodle.org/en/Moodle_1.8.12_release_notes

Plugin Details

Severity: High

ID: 5504

Family: CGI

Published: 4/7/2010

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:moodle:moodle

Patch Publication Date: 3/25/2010

Vulnerability Publication Date: 4/1/2010

Reference Information

CVE: CVE-2010-1613, CVE-2010-1614, CVE-2010-1615, CVE-2010-1616, CVE-2010-1617, CVE-2010-1618, CVE-2010-1619

BID: 39150