Summary
Moodle is prone to multiple vulnerabilities, including:
- a cross-site scripting issue
- a security-bypass issue
- an HTML-injection issue
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie- based authentication credentials and to control how the site is rendered to the user
other attacks are also possible.
These issues affect versions prior to Moodle 1.9.9 and 1.8.13.
Solution
Updates are available. Please see the references for more information.
References
- http://moodle.org/mod/forum/discuss.php?d=152366
- http://moodle.org/mod/forum/discuss.php?d=152367
- http://moodle.org/mod/forum/discuss.php?d=152368
- http://moodle.org/mod/forum/discuss.php?d=152369
- http://moodle.org/security/
- http://www.moodle.org
- https://www.securityfocus.com/bid/40944
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2010-2228, CVE-2010-2229, CVE-2010-2230, CVE-2010-2231 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities
- Adobe ColdFusion Multiple Path Disclosure Vulnerabilities
- Apache Tomcat Login Constraints Security Bypass Vulnerability
- AdaptCMS Lite Cross Site Scripting and Remote File Include Vulnerabilities
- Adobe JRun Management Console Multiple Vulnerabilities