Detections
Analytics
Moodle 2.7.x < 2.7.17 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 9832
Synopsis
The remote web server is hosting a web application that is vulnerable to multiple attack vectors.Description
The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.7.x prior to 2.7.17 are affected by multiple vulnerabilities :- A flaw exists in the question engine that may allow an authenticated remote attacker to download files embedded in questions from the system by guessing the URL of the file downloading it using the identifier of a question they are authorized to access.
- A flaw exists in an unspecified web service that may allow a non-administrative remote attacker to make changes to administrative information for other users.
- A flaw exists that is due to the program failing to properly perform capability checks on users who have site-wide permissions which were revoked within a specific course. This may allow an authenticated remote attacker to disclose course note information.
Solution
Upgrade to Moodle version 2.7.17 or later.See Also
Plugin Details
Severity: Medium
ID: 9832
Family: CGI
Published: 12/16/2016
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 5.2
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:moodle:moodle
Patch Publication Date: 11/21/2016
Vulnerability Publication Date: 11/21/2016