Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Moodle 2.3.x < 2.3.8 Multiple Vulnerabilities

Medium

Synopsis

The remote web server is hosting a web application that is vulnerable to multiple attack vectors.

Description

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.3.x prior to 2.3.8 are exposed to the following vulnerabilities :

- A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access. This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242) - A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to the program failing to properly restrict users using view source on pages. This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243) - A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245) - A flaw exists that may lead to the unauthorized disclosure of sensitive information. The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'. This will result in personal information being exposed to a remote attacker. (CVE-2013-2246) - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information. The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred. This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

Solution

Upgrade to Moodle version 2.3.8 or later.